CVE-2004-0886

Description

Multiple integer overflows in libtiff 3.6.1 and earlier allow remote attackers to cause a denial of service (crash or memory corruption) via TIFF images that lead to incorrect malloc calls.

Affected products

• Apple / mac_os_x10.2.4 – 10.2.4
• Apple / mac_os_x10.2.5 – 10.2.5
• Apple / mac_os_x10.2.6 – 10.2.6
• Apple / mac_os_x10.2.7 – 10.2.7
• Apple / mac_os_x10.2.8 – 10.2.8
• Apple / mac_os_x10.3 – 10.3
• Apple / mac_os_x10.3.6 – 10.3.6
• Apple / mac_os_x10.3.5 – 10.3.5
• Apple / mac_os_x10.3.4 – 10.3.4
• Apple / mac_os_x10.3.3 – 10.3.3
• Apple / mac_os_x10.3.2 – 10.3.2
• Apple / mac_os_x10.3.1 – 10.3.1
• Apple / mac_os_x10.2 – 10.2
• Apple / mac_os_x10.2.1 – 10.2.1
• Apple / mac_os_x10.2.2 – 10.2.2
• Apple / mac_os_x10.2.3 – 10.2.3
• Apple / mac_os_x_server10.3 – 10.3
• Apple / mac_os_x_server10.3.2 – 10.3.2
• Apple / mac_os_x_server10.3.3 – 10.3.3
• Apple / mac_os_x_server10.3.4 – 10.3.4
• Apple / mac_os_x_server10.3.5 – 10.3.5
• Apple / mac_os_x_server10.3.6 – 10.3.6
• Apple / mac_os_x_server10.2.4 – 10.2.4
• Apple / mac_os_x_server10.2.5 – 10.2.5
• Apple / mac_os_x_server10.2.6 – 10.2.6
• Apple / mac_os_x_server10.2.7 – 10.2.7
• Apple / mac_os_x_server10.2.8 – 10.2.8
• Apple / mac_os_x_server10.3.1 – 10.3.1
• Apple / mac_os_x_server10.2 – 10.2
• Apple / mac_os_x_server10.2.1 – 10.2.1
• Apple / mac_os_x_server10.2.2 – 10.2.2
• Apple / mac_os_x_server10.2.3 – 10.2.3
• KDE / kde3.2.3 – 3.2.3
• KDE / kde3.3 – 3.3
• KDE / kde3.3.1 – 3.3.1
• KDE / kde3.2.2 – 3.2.2
• KDE / kde3.2.1 – 3.2.1
• KDE / kde3.2 – 3.2
• libtiff / libtiff3.4 – 3.4
• libtiff / libtiff3.5.1 – 3.5.1
• libtiff / libtiff3.5.2 – 3.5.2
• libtiff / libtiff3.5.3 – 3.5.3
• libtiff / libtiff3.5.4 – 3.5.4
• libtiff / libtiff3.5.5 – 3.5.5
• libtiff / libtiff3.5.7 – 3.5.7
• libtiff / libtiff3.6.0 – 3.6.0
• libtiff / libtiff3.6.1 – 3.6.1
• mandrakesoft / mandrake_linux10.0 – 10.0
• mandrakesoft / mandrake_linux10.0 – 10.0
• pdflib / pdf_library5.0.2 – 5.0.2
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux_desktop3.0 – 3.0
• RedHat / fedora_corecore_2.0 – core_2.0
• RedHat / linux_advanced_workstation2.1 – 2.1
• RedHat / linux_advanced_workstation2.1 – 2.1
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.1 – 9.1
• SUSE / suse_linux1.0 – 1.0
• SUSE / suse_linux8 – 8
• SUSE / suse_linux8.1 – 8.1
• SUSE / suse_linux8.2 – 8.2
• SUSE / suse_linux9.0 – 9.0
• trustix / secure_linux2.1 – 2.1
• trustix / secure_linux1.5 – 1.5
• trustix / secure_linux2.0 – 2.0
• wxgtk2 / wxgtk2
• wxgtk2 / wxgtk22.5_.0 – 2.5_.0

References

• MISChttp://www.redhat.com/support/errata/RHSA-2004-577.html
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:109
• MISChttp://www.redhat.com/support/errata/RHSA-2005-021.html
• MISChttp://www.ciac.org/ciac/bulletins/p-015.shtml
• MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9907
• MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
• VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2004_38_libtiff.html
• MISChttp://www.kb.cert.org/vuls/id/687568
• MISChttp://securitytracker.com/id?1011674
• MISChttp://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:052
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/17715
• MISChttp://www.trustix.org/errata/2004/0054/
• MISChttp://www.kde.org/info/security/advisory-20041209-2.txt
• MISChttp://www.redhat.com/support/errata/RHSA-2005-354.html
• VENDOR_ADVISORYhttp://secunia.com/advisories/12818
• MISChttp://www.securityfocus.com/bid/11406
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100116
• VENDOR_ADVISORYhttp://www.debian.org/security/2004/dsa-567
• MAILING_LISThttp://marc.info/?l=bugtraq&m=109779465621929&w=2