CVE-2010-4665

Published: 3 May 2011

Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF file containing a directory data structure with many directory entries.

Notes

Author	Note
mdeslaur	only affects tiffdump tool

Priority

Status

Package	Release	Status
tiff Launchpad, Ubuntu, Debian	dapper	Ignored (end of life)
	hardy	Released (3.8.2-7ubuntu3.10)
	lucid	Released (3.9.2-2ubuntu0.8)
	maverick	Released (3.9.4-2ubuntu0.5)
	natty	Released (3.9.4-5ubuntu6.1)
	oneiric	Not vulnerable (3.9.5-1ubuntu1)
	upstream	Released (3.9.5)

References

https://ubuntu.com/security/notices/USN-1416-1
https://www.cve.org/CVERecord?id=CVE-2010-4665
NVD
Launchpad
Debian

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=695887
http://bugzilla.maptools.org/show_bug.cgi?id=2218

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›