CVE-2010-1411 - Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTI

CVE-2010-1411

Summary

Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTIFF before 3.9.3, as used in ImageIO in Apple Mac OS X 10.5.8 and Mac OS X 10.6 before 10.6.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file that triggers a heap-based buffer overflow.

References

Vulnerable Configurations

cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 15-05-2013 - 03:08)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

redhat via4

advisories

rhsa
id RHSA-2010:0519
rhsa
id RHSA-2010:0520

rpms

libtiff-0:3.6.1-12.el4_8.5
libtiff-0:3.8.2-7.el5_5.5
libtiff-debuginfo-0:3.6.1-12.el4_8.5
libtiff-debuginfo-0:3.8.2-7.el5_5.5
libtiff-devel-0:3.6.1-12.el4_8.5
libtiff-devel-0:3.8.2-7.el5_5.5
libtiff-0:3.5.7-34.el3
libtiff-debuginfo-0:3.5.7-34.el3
libtiff-devel-0:3.5.7-34.el3

refmap via4

apple	APPLE-SA-2010-06-15-1 APPLE-SA-2010-06-16-1
bid	40823
confirm	http://support.apple.com/kb/HT4188 http://support.apple.com/kb/HT4196 http://support.apple.com/kb/HT4220 http://www.remotesensing.org/libtiff/v3.9.3.html https://bugzilla.redhat.com/show_bug.cgi?id=592361
fedora	FEDORA-2010-10460 FEDORA-2010-10469
gentoo	GLSA-201209-02
mlist	[oss-security] 20100623 CVE requests: LibTIFF
sectrack	1024103
secunia	40181 40196 40220 40381 40478 40527 40536 50726
slackware	SSA:2010-180-02
suse	SUSE-SR:2010:014
ubuntu	USN-954-1
vupen	ADV-2010-1435 ADV-2010-1481 ADV-2010-1512 ADV-2010-1638 ADV-2010-1731 ADV-2010-1761

Last major update

15-05-2013 - 03:08

Published

17-06-2010 - 16:30

Last modified

15-05-2013 - 03:08