CVE-2010-2598

Publication date 2 July 2010

Last updated 24 July 2024

LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to “downsampled OJPEG input.”

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
tiff	10.10 maverick	Fixed 3.9.4-2ubuntu0.1
	10.04 LTS lucid	Fixed 3.9.2-2ubuntu0.4
	9.10 karmic	Fixed 3.8.2-13ubuntu0.4
	9.04 jaunty	Ignored end of life
	8.04 LTS hardy	Fixed 3.8.2-7ubuntu3.7
	6.06 LTS dapper	Fixed 3.7.4-1ubuntu3.9

How can I get the fixes?
What do statuses mean?

Notes

mdeslaur

Same patch as CVE-2010-2597

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-1085-1
tiff vulnerabilities
7 March 2011

Other references

https://www.cve.org/CVERecord?id=CVE-2010-2598