Synopsis

libtiff security update

Type/Severity

Security Advisory: Important

Topic

Updated libtiff packages that fix various integer overflows are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat
Security Response Team

Description

The libtiff package contains a library of functions for manipulating TIFF
(Tagged Image File Format) image format files.

infamous41md discovered integer overflow flaws in libtiff. An attacker
could create a carefully crafted TIFF file in such a way that it could
cause an application linked with libtiff to overflow a heap buffer when the
file was opened by a victim. Due to the nature of the overflow it is
unlikely that it is possible to use this flaw to execute arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1308 to this issue.

Dmitry V. Levin discovered an integer overflow flaw in libtiff. An
attacker could create a carefully crafted TIFF file in such a way that it
could cause an application linked with libtiff to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-1183 to this issue.

All users are advised to upgrade to these updated packages, which contain
backported fixes for these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 144185 - CAN-2004-1308 LibTIFF Directory Entry Count Integer Overflow Vulnerability
• BZ - 144186 - CAN-2004-1183 libtiff integer overflow

CVEs

• CVE-2004-1308
• CVE-2004-1183

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
libtiff-3.6.1-8.src.rpm	SHA-256: eb774ac9c0d6678f0bd2a9b91ae2de160145482423bfc8ee98ec207cc4b33dec
x86_64
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.x86_64.rpm	SHA-256: 29ff073c1c0d62a34bf64103fde3cd43f901ac85629c0b0f071d89b98d01acce
libtiff-3.6.1-8.x86_64.rpm	SHA-256: 29ff073c1c0d62a34bf64103fde3cd43f901ac85629c0b0f071d89b98d01acce
libtiff-devel-3.6.1-8.x86_64.rpm	SHA-256: 7b0520c8817f68af106ea7880dc6352fc634461e8e42918eb6ed800da5858c43
libtiff-devel-3.6.1-8.x86_64.rpm	SHA-256: 7b0520c8817f68af106ea7880dc6352fc634461e8e42918eb6ed800da5858c43
ia64
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.ia64.rpm	SHA-256: b931bd88e5cbdc844d31b4192e50dd26bd6a13f71f3195e6ffeb3ad82827befa
libtiff-3.6.1-8.ia64.rpm	SHA-256: b931bd88e5cbdc844d31b4192e50dd26bd6a13f71f3195e6ffeb3ad82827befa
libtiff-devel-3.6.1-8.ia64.rpm	SHA-256: bd4c20f94a1bde65c74d205f8365347d97186f6755f9701ada77f7bf7716e282
libtiff-devel-3.6.1-8.ia64.rpm	SHA-256: bd4c20f94a1bde65c74d205f8365347d97186f6755f9701ada77f7bf7716e282
i386
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-devel-3.6.1-8.i386.rpm	SHA-256: f20706a8135696aad0b6886c6ca852e32aa4a7d8e440fa4e1f37c638568e9edb
libtiff-devel-3.6.1-8.i386.rpm	SHA-256: f20706a8135696aad0b6886c6ca852e32aa4a7d8e440fa4e1f37c638568e9edb

Red Hat Enterprise Linux Workstation 4

SRPM
libtiff-3.6.1-8.src.rpm	SHA-256: eb774ac9c0d6678f0bd2a9b91ae2de160145482423bfc8ee98ec207cc4b33dec
x86_64
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.x86_64.rpm	SHA-256: 29ff073c1c0d62a34bf64103fde3cd43f901ac85629c0b0f071d89b98d01acce
libtiff-devel-3.6.1-8.x86_64.rpm	SHA-256: 7b0520c8817f68af106ea7880dc6352fc634461e8e42918eb6ed800da5858c43
ia64
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.ia64.rpm	SHA-256: b931bd88e5cbdc844d31b4192e50dd26bd6a13f71f3195e6ffeb3ad82827befa
libtiff-devel-3.6.1-8.ia64.rpm	SHA-256: bd4c20f94a1bde65c74d205f8365347d97186f6755f9701ada77f7bf7716e282
i386
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-devel-3.6.1-8.i386.rpm	SHA-256: f20706a8135696aad0b6886c6ca852e32aa4a7d8e440fa4e1f37c638568e9edb

Red Hat Enterprise Linux Desktop 4

SRPM
libtiff-3.6.1-8.src.rpm	SHA-256: eb774ac9c0d6678f0bd2a9b91ae2de160145482423bfc8ee98ec207cc4b33dec
x86_64
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-3.6.1-8.x86_64.rpm	SHA-256: 29ff073c1c0d62a34bf64103fde3cd43f901ac85629c0b0f071d89b98d01acce
libtiff-devel-3.6.1-8.x86_64.rpm	SHA-256: 7b0520c8817f68af106ea7880dc6352fc634461e8e42918eb6ed800da5858c43
i386
libtiff-3.6.1-8.i386.rpm	SHA-256: dd40d7589a6353b632c27374dce4eaa3423d1dc7e7b4f5643ee9a91e671a02d0
libtiff-devel-3.6.1-8.i386.rpm	SHA-256: f20706a8135696aad0b6886c6ca852e32aa4a7d8e440fa4e1f37c638568e9edb

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
libtiff-3.6.1-8.src.rpm	SHA-256: eb774ac9c0d6678f0bd2a9b91ae2de160145482423bfc8ee98ec207cc4b33dec
s390x
libtiff-3.6.1-8.s390.rpm	SHA-256: da123f6a398d517228d2d7b8270658f283ae359f2a80d3f27babd2645c99e91c
libtiff-3.6.1-8.s390x.rpm	SHA-256: 9645354cf33bb1001c2ff2e72d1d80b40227cd98382776f504662e73caf56067
libtiff-devel-3.6.1-8.s390x.rpm	SHA-256: d1b0a0461eddeb8083680452c155521ae0eb7bf2a5924ef1b401e50aaa79565f
s390
libtiff-3.6.1-8.s390.rpm	SHA-256: da123f6a398d517228d2d7b8270658f283ae359f2a80d3f27babd2645c99e91c
libtiff-devel-3.6.1-8.s390.rpm	SHA-256: 35f5f7cbc488d05eff172b98294bb6e4e100c013d14c58b398c30fe391d0287f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
libtiff-3.6.1-8.src.rpm	SHA-256: eb774ac9c0d6678f0bd2a9b91ae2de160145482423bfc8ee98ec207cc4b33dec
ppc
libtiff-3.6.1-8.ppc.rpm	SHA-256: 87332e38a75551338a7b9489a203f5e27e29e777987430318838d77d263452ff
libtiff-3.6.1-8.ppc64.rpm	SHA-256: bf10f644773d03c9d38f9d4b922f6051bd60b9982ea9cb1c9d4118c124ff3164
libtiff-devel-3.6.1-8.ppc.rpm	SHA-256: 4b800b537ccd7a7ee3afe3125ca5c19dae4adc9bdb82a834cdf4e8746d6863f9