1. Ubuntu Security Notices
  2. USN-1102-1

USN-1102-1: tiff vulnerability

Publication date

4 April 2011

Overview

Certain applications could be made to run programs as your login if they opened a specially crafted TIFF file.

Releases

Packages

  • tiff - TIFF manipulation and conversion tools

Details

Martin Barbella discovered that the thunder (aka ThunderScan) decoder in
the TIFF library incorrectly handled an unexpected BitsPerSample value. If
a user or automated system were tricked into opening a specially crafted
TIFF image, a remote attacker could execute arbitrary code with user
privileges, or crash the application, leading to a denial of service.

Martin Barbella discovered that the thunder (aka ThunderScan) decoder in
the TIFF library incorrectly handled an unexpected BitsPerSample value. If
a user or automated system were tricked into opening a specially crafted
TIFF image, a remote attacker could execute arbitrary code with user
privileges, or crash the application, leading to a denial of service.

Update instructions

After a standard system update you need to restart your session to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic libtiff4 –  3.8.2-13ubuntu0.6
8.04 hardy libtiff4 –  3.8.2-7ubuntu3.9
6.06 dapper libtiff4 –  3.7.4-1ubuntu3.11
10.10 maverick libtiff4 –  3.9.4-2ubuntu0.3
10.04 lucid libtiff4 –  3.9.2-2ubuntu0.6

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›