Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Patches » RHSA-2012:1590-01

Overview

Id RHSA-2012:1590-01
Name Red Hat 2012:1590-01 RHSA Moderate: libtiff security update for RHEL 5 x86
Vendor Name red_hat
Product None
Content Type Critical Critical
Language(s)
Operating System(s) Linux 
Released On 18 Dec 2012 12:00:00

RHSA-2012:1590-01

Red Hat 2012:1590-01 RHSA Moderate: libtiff security update for RHEL 5 x86

Vendor Name

red_hat

Product

None

Released On

18 Dec 2012 12:00:00

Url

https://rhn.redhat.com/errata/RHSA-2012-1590.html

Description

LSAC(v2)
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF images using the Pixar Log Format encoding. An attacker could create a specially-crafted TIFF file that, when opened, could cause an application using libtiff to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4447) A stack-based buffer overflow flaw was found in the way libtiff handled DOTRANGE tags. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-5581) A heap-based buffer overflow flaw was found in the tiff2pdf tool. An attacker could use this flaw to create a specially-crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. (CVE-2012-3401) A missing return value check flaw, leading to a heap-based buffer overflow, was found in the ppm2tiff tool. An attacker could use this flaw to create a specially-crafted PPM (Portable Pixel Map) file that would cause ppm2tiff to crash or, possibly, execute arbitrary code. (CVE-2012-4564) The CVE-2012-5581, CVE-2012-3401, and CVE-2012-4564 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team. All libtiff users should upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect.

Related Resources

Related Vulnerabilities

CVE-2012-3401   CVE-2012-4447   CVE-2012-4564   CVE-2012-5581  

Related Patches

None

Superseded Patches


Last Updated: 27 May 2016 11:15:57