USN-289-1: tiff vulnerabilities

Releases

• Ubuntu 6.06
• Ubuntu 5.10
• Ubuntu 5.04

Details

A buffer overflow has been found in the tiff2pdf utility. By tricking
an user into processing a specially crafted TIF file with tiff2pdf,
this could potentially be exploited to execute arbitrary code with the
privileges of the user. (CVE-2006-2193)

A. Alejandro Hernández discovered a buffer overflow in the tiffsplit
utility. By calling tiffsplit with specially crafted long arguments,
an user can execute arbitrary code. If tiffsplit is used in e. g. a
web-based frontend or similar automated system, this could lead to
remote arbitary code execution with the privileges of that system. (In
normal interactive command line usage this is not a vulnerability.)
(CVE-2006-2656)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 6.06

• libtiff-tools - 3.7.4-1ubuntu3.1

Ubuntu 5.10

• libtiff-tools - 3.7.3-1ubuntu1.4

Ubuntu 5.04

• libtiff-tools - 3.6.1-5ubuntu0.5

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2006-2193
• CVE-2006-2656