Objavljena je nadogradnja programskog paketa TIFF koja ispravlja nekoliko uočenih sigurnosnih nedostataka. Radi se o programskom paketu koji se koristi za rukovanje TIFF (eng. Tagged Image File Format) datotekama. Ispravljeni nedostaci vezani su uz prepisivanja međuspremnika do kojih dolazi prilikom obrade posebno oblikovanih TIFF datoteka. Zlonamjerni korisnici to mogu iskoristiti za izvršavanje proizvoljnog programskog koda te pokretanje napada uskraćivanja usluge. Svim se korisnicima savjetuje primjena objavljene nadogradnje.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2210-1                   Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
http://www.debian.org/security/                           Thijs Kinkhorst      
 
April 03, 2011                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tiff
Vulnerability  : several
Problem type   : local (remote)
Debian-specific: no
CVE ID         : CVE-2011-0191 CVE-2011-0192 CVE-2011-1167
Debian Bug     : 619614

Several vulnearbilities were discovered in the TIFF manipulation and
conversion library:

CVE-2011-0191

  A buffer overflow allows to execute arbitrary code or cause
  a denial of service via a crafted TIFF image with JPEG encoding.
  This issue affects the Debian 5.0 Lenny package only.

CVE-2011-0192

  A buffer overflow allows to execute arbitrary code or cause
  a denial of service via a crafted TIFF Internet Fax image
  file that has been compressed using CCITT Group 4 encoding.

CVE-2011-1167

  Heap-based buffer overflow in the thunder (aka ThunderScan)
  decoder allows to execute arbitrary code via a TIFF file that
  has an unexpected BitsPerSample value.

For the oldstable distribution (lenny), these problems have been
fixed in version 3.8.2-11.4.

For the stable distribution (squeeze), these problems have been
fixed in version 3.9.4-5+squeeze1.

For the testing distribution, the first two problems have been fixed
in version 3.9.4-8, the last problem will be fixed soon.

For the unstable distribution (sid), these problems have been fixed
in version 3.9.4-9.

We recommend that you upgrade your tiff packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJNmGY/AAoJEOxfUAG2iX57sn0IAKOY9jC+wBs+9pLl6ksUcP5U
HcyV7IMDqNOz/JFPSaDWIxaQnmmA5+9bJv+kIsOOTfrN3PYPYeN2ZqQQK0aB4Hy5
GqPpzA/OqpLragrOaB6OyHfeV2bt0fRLYMFyk1QWAWnAPElnLjOikgyoaAKRzoIJ
HBUC6NjeYTIH96rMnkwnWXde2A3eBXs4frBOdDMBrP4KOZ1voM8T0h1CyZKakJxL
HeGfK24q1HIdb2kJPEPwoTKtJyqxBaGQAYAbgnlAaitDKA84rJUrBeA3IHqMGrwt
MXyi+OpYoFtQGLIYaLzMZzlhhdTnLLdvPy+vGTZ/YelHbCSmsUezsIEEP1Blm7U=
=HW7P
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
with a subject of "unsubscribe". Trouble? Contact Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Archive: http://lists.debian.org/Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.