Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in libtiff
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in libtiff
ID: MDVSA-2013:208
Distribution: Mandriva
Plattformen: Mandriva Business Server 1.0
Datum: Di, 6. August 2013, 16:43
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0142
Applikationen: libtiff

Originalnachricht

This is a multi-part message in MIME format...

------------=_1375796546-3002-17

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:208
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : libtiff
Date : August 6, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated libtiff packages fix security vulnerabilities:

A heap-based buffer overflow flaw was found in the way tiff2pdf of
libtiff performed write of TIFF image content into particular PDF
document file, in the tp_process_jpeg_strip() function. A remote
attacker could provide a specially-crafted TIFF image format file,
that when processed by tiff2pdf would lead to tiff2pdf executable
crash or, potentially, arbitrary code execution with the privileges
of the user running the tiff2pdf binary (CVE-2013-1960).

A stack-based buffer overflow was found in the way tiff2pdf of libtiff
performed write of TIFF image content into particular PDF document
file, when malformed image-length and resolution values are used in
the TIFF file. A remote attacker could provide a specially-crafted
TIFF image format file, that when processed by tiff2pdf would lead
to tiff2pdf executable crash (CVE-2013-1961).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0142
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
a220e740d95cecb9ba75e7cc7da597e1
mbs1/x86_64/lib64tiff5-4.0.1-3.2.mbs1.x86_64.rpm
14f548564a07eb9b4f227dc7892b968d
mbs1/x86_64/lib64tiff-devel-4.0.1-3.2.mbs1.x86_64.rpm
e41641f5e59c3cce2b83be367ed16512
mbs1/x86_64/lib64tiff-static-devel-4.0.1-3.2.mbs1.x86_64.rpm
a096aca7f52ec8a391aeda5e113e2adf
mbs1/x86_64/libtiff-progs-4.0.1-3.2.mbs1.x86_64.rpm
62ecd6b8fd59cd5fa3842b2fc5dab7da mbs1/SRPMS/libtiff-4.0.1-3.2.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSANLfmqjQ0CJFipgRAn1/AJ44LlXCPQh0MvsVE1bNeKr++zauHACfcFGI
iswCZnfiWU/KS1x+yzk1CaE=
=2MNg
-----END PGP SIGNATURE-----


------------=_1375796546-3002-17
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1375796546-3002-17--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung