Synopsis:          Moderate: libtiff security update

Advisory ID:       SLSA-2014:0223-1

Issue Date:        2014-02-27

CVE Numbers:       CVE-2013-1961

                   CVE-2013-1960

                   CVE-2013-4231

                   CVE-2013-4232

                   CVE-2013-4243

                   CVE-2013-4244

--



A heap-based buffer overflow and a use-after-free flaw were found in the

tiff2pdf tool. An attacker could use these flaws to create a specially

crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute

arbitrary code. (CVE-2013-1960, CVE-2013-4232)



Multiple buffer overflow flaws were found in the gif2tiff tool. An

attacker could use these flaws to create a specially crafted GIF file that

could cause gif2tiff to crash or, possibly, execute arbitrary code.

(CVE-2013-4231, CVE-2013-4243, CVE-2013-4244)



Multiple buffer overflow flaws were found in the tiff2pdf tool. An

attacker could use these flaws to create a specially crafted TIFF file

that would cause tiff2pdf to crash. (CVE-2013-1961)



All running applications linked against libtiff must be restarted for this

update to take effect.

--



SL5

  x86_64

    libtiff-3.8.2-19.el5_10.i386.rpm

    libtiff-3.8.2-19.el5_10.x86_64.rpm

    libtiff-debuginfo-3.8.2-19.el5_10.i386.rpm

    libtiff-debuginfo-3.8.2-19.el5_10.x86_64.rpm

    libtiff-devel-3.8.2-19.el5_10.i386.rpm

    libtiff-devel-3.8.2-19.el5_10.x86_64.rpm

  i386

    libtiff-3.8.2-19.el5_10.i386.rpm

    libtiff-debuginfo-3.8.2-19.el5_10.i386.rpm

    libtiff-devel-3.8.2-19.el5_10.i386.rpm



- Scientific Linux Development Team