Rapid7 Vulnerability & Exploit Database

ELSA-2011-0318 Important: Oracle Linux libtiff security update

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

ELSA-2011-0318 Important: Oracle Linux libtiff security update

Severity

CVSS

(AV:N/AC:M/Au:N/C:C/I:C/A:C)

Published

03/03/2011

Created

07/25/2018

Added

12/20/2011

Modified

07/04/2017

Description

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

Solution(s)

oracle-linux-upgrade-libtiff
oracle-linux-upgrade-libtiff-devel
oracle-linux-upgrade-libtiff-static

References

https://attackerkb.com/topics/cve-2011-0192
APPLE-SA-2011-03-02-1
APPLE-SA-2011-03-09-1
APPLE-SA-2011-03-09-2
APPLE-SA-2011-03-09-3
APPLE-SA-2011-03-21-1
APPLE-SA-2011-10-12-1
APPLE-SA-2011-10-12-2
46658
CVE - 2011-0192
DSA-2210
RHSA-2011:0318
http://oss.oracle.com/pipermail/el-errata/2011-March/001972.html
http://oss.oracle.com/pipermail/el-errata/2011-March/001973.html
http://oss.oracle.com/pipermail/el-errata/2011-March/001974.html

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;