| Description: | Description:
The remote host is missing updates announced in
advisory FLSA-2005:152815.
During a source code audit, Chris Evans discovered a number of integer
overflow bugs that affect libtiff. An attacker who has the ability to
trick a user into opening a malicious TIFF file could cause the
application linked to libtiff to crash or possibly execute arbitrary
code. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues.
Additionally, a number of buffer overflow bugs that affect libtiff have
been found. An attacker who has the ability to trick a user into opening
a malicious TIFF file could cause the application linked to libtiff to
crash or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to
this issue.
iDEFENSE has reported an integer overflow bug that affects libtiff. An
attacker who has the ability to trick a user into opening a malicious
TIFF file could cause the application linked to libtiff to crash or
possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to
this issue.
Dmitry V. Levin reported another integer overflow in the tiffdump
utility. An atacker who has the ability to trick a user into opening a
malicious TIFF file with tiffdump could possibly execute arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1183 to this issue.
All users are advised to upgrade to these updated packages, which
contain backported fixes for these issues.
Affected platforms:
Redhat 7.3
Redhat 9
Fedora Core 1
Solution:
https://secure1.securityspace.com/smysecure/catid.html?in=FLSA-2005:152815
Risk factor : Critical
CVSS Score:
10.0
|
