PT-2011-1183 · Libtiff+2 · Libtiff+2

Published 2011-03-03 · Updated 2024-06-15 · CVE-2011-0192

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibTIFF versions 3.9.4 and possibly other versions tiff package versions prior to 4.0.2-r1

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding. This is related to the EXPAND2D macro in libtiff/tif fax3.h. Multiple vulnerabilities in the tiff package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For LibTIFF version 3.9.4, consider updating to a newer version to mitigate the risk. For tiff package versions prior to 4.0.2-r1, update to version 4.0.2-r1 or later to resolve the issue. As a temporary workaround, consider restricting the use of TIFF Internet Fax image files that have been compressed using CCITT Group 4 encoding until a patch is available.

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-09646

CVE-2011-0192

DSA-2210-1

OPENSUSE-SU-2024:10554-1

RHSA-2011:0318

RHSA-2011_0318

Affected Products

Libtiff

Red Hat

Tiff

References · 103

• https://bdu.fstec.ru/vul/2015-09646 · Security Note
• http://debian.org/security/2011/dsa-2210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0192 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055683.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057763.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0192 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057840.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:043 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0192 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html · Vendor Advisory