Synopsis

Important: libtiff security and bug fix update

Type/Severity

Security Advisory: Important

Topic

Updated libtiff packages that fix a security issue and a bug are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The libtiff packages contain a library of functions for manipulating Tagged
Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's
Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could
create a carefully crafted LZW-encoded TIFF file that would cause an
application linked with libtiff to crash or, possibly, execute arbitrary
code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for
reporting this issue.

Additionally, these updated packages fix the following bug:

• the libtiff packages included manual pages for the sgi2tiff and tiffsv
  commands, which are not included in these packages. These extraneous manual
  pages were removed.
  

All libtiff users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 458674 - CVE-2008-2327 libtiff: use of uninitialized memory in LZW decoder
• BZ - 460120 - [RHEL5] libtiff has unnecessary man pages.

CVEs

• CVE-2008-2327

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
x86_64
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: de044f7a0ad74ac911c4ece0edcfe8854acc61bd5668d966a9ab915e54fb7709
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262
libtiff-devel-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: 3750ee1ecf7ad5c5756911a4b803e19b03074f73dc089fadafa9d48d26fd63be
ia64
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-3.8.2-7.el5_2.2.ia64.rpm	SHA-256: 6845ee83919c91255a57abc16c57ffd821a594eedb4439eccab139ae0fd1d38f
libtiff-devel-3.8.2-7.el5_2.2.ia64.rpm	SHA-256: 9de3c0af056435b7d1091df5b495758cc097084b0f59d559fb4d930c4346b04a
i386
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262

Red Hat Enterprise Linux Workstation 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
x86_64
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: de044f7a0ad74ac911c4ece0edcfe8854acc61bd5668d966a9ab915e54fb7709
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262
libtiff-devel-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: 3750ee1ecf7ad5c5756911a4b803e19b03074f73dc089fadafa9d48d26fd63be
i386
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262

Red Hat Enterprise Linux Desktop 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
x86_64
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: de044f7a0ad74ac911c4ece0edcfe8854acc61bd5668d966a9ab915e54fb7709
i386
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
s390x
libtiff-3.8.2-7.el5_2.2.s390.rpm	SHA-256: 0393614e44cd93a0aaf76590fde43a31bfaea83aebc245789aef52c932ccbc2a
libtiff-3.8.2-7.el5_2.2.s390x.rpm	SHA-256: 9710f2891dc901036d5aa768ad2c360b22606f2804f27b5d7dbea06c4c441385
libtiff-devel-3.8.2-7.el5_2.2.s390.rpm	SHA-256: 75394e8cc29df43cba7e6effd3d9beff5f5a15a56ffabc93a0802c40cc963bb0
libtiff-devel-3.8.2-7.el5_2.2.s390x.rpm	SHA-256: 680986c99bf5cee393bcd432eddc96073c910404180d059334f34a66c33c1a7f

Red Hat Enterprise Linux for Power, big endian 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
ppc
libtiff-3.8.2-7.el5_2.2.ppc.rpm	SHA-256: b2bd16bc48f4fb6f868c8eb3116acb9e4522c9ef40ce058bd847791adbc3ba2c
libtiff-3.8.2-7.el5_2.2.ppc64.rpm	SHA-256: eb779bc1462f89c9d806d1af741124e4364050ec44b9d3838298715fc34a12c0
libtiff-devel-3.8.2-7.el5_2.2.ppc.rpm	SHA-256: 58d2b2235c6eecc9aa732db42c9c4a119c81531edce55d71d201f26d5b375bab
libtiff-devel-3.8.2-7.el5_2.2.ppc64.rpm	SHA-256: 60061e48da990a8947fb2ab4194318ffb6f5f6cdf4184d78f6ac5f9093f54a0d

Red Hat Enterprise Linux Server from RHUI 5

SRPM
libtiff-3.8.2-7.el5_2.2.src.rpm	SHA-256: 9413a00d305752b9b7e777fbb249889d00d47380d708aa4315db73728c9dfd72
x86_64
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: de044f7a0ad74ac911c4ece0edcfe8854acc61bd5668d966a9ab915e54fb7709
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262
libtiff-devel-3.8.2-7.el5_2.2.x86_64.rpm	SHA-256: 3750ee1ecf7ad5c5756911a4b803e19b03074f73dc089fadafa9d48d26fd63be
i386
libtiff-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 8fb02f3c946d4df1365cfe52c488aa27a9841a9a388dbacd5e93a9eef9356ccd
libtiff-devel-3.8.2-7.el5_2.2.i386.rpm	SHA-256: 3b1e4b979f55011ef3563de2a9503c119851bd67072ffaf75fdd6ff943f86262