Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.5.0-r2 | >= 4.5.0-r2 |
LibTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Multiple vulnerabilities have been discovered in LibTIFF. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All LibTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.5.0-r2"
Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.4.0 | >= 4.4.0 |
LibTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Multiple vulnerabilities have been discovered in LibTIFF. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All LibTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.4.0"
Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.2.0 | >= 4.2.0 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
Multiple vulnerabilities have been discovered in LibTIFF. Please review the referenced CVE identifiers for details.
A remote attacker, by enticing the user to process a specially crafted TIFF file, could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All LibTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.2.0"
Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.1.0 | >= 4.1.0 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
Multiple vulnerabilities have been discovered in libTIFF. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing the user to process a specially crafted TIFF file, could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.1.0"
A vulnerability in libTIFF could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.0.10 | >= 4.0.10 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
Please review the CVE identifier referenced below for details.
Please review the CVE identifier referenced below for details.
There is no known workaround at this time.
All tiff users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.10"
Multiple vulnerabilities have been found in LibTIFF, the worst of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.0.8 | >= 4.0.8 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
Multiple vulnerabilities have been discovered in LibTIFF. Please review the referenced CVE identifiers for details.
A remote attacker, by enticing the user to process a specially crafted TIFF file, could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or have other unspecified impacts.
There is no known workaround at this time.
All LibTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.8"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities have been found in libTIFF, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.0.7 | >= 4.0.7 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
Multiple vulnerabilities have been discovered in libTIFF. Please review the CVE identifier and bug reports referenced for details.
A remote attacker could entice a user to process a specially crafted image file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.7"
Multiple vulnerabilities have been found in libTIFF, allowing remote attackers to execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.0.3-r6 | >= 4.0.3-r6, >= 3.9.7-r1 (revision) |
libTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Multiple vulnerabilities have been discovered in libTIFF. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted TIFF file with an application making use of libTIFF, possibly resulting in execution of arbitrary code with the privileges of the user running the application or a Denial of Service condition.
There is no known workaround at this time.
All libTIFF 4.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.3-r6"
All libTIFF 3.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.9.7-r1:3"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
Multiple vulnerabilities in libTIFF could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 4.0.2-r1 | >= 4.0.2-r1, >= 3.9.5-r2 (revision), >= 3.9.7-r1 (revision) |
libTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Multiple vulnerabilities have been discovered in libTIFF. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted TIFF file with an application making use of libTIFF, possibly resulting in execution of arbitrary code with the privileges of the user running the application or a Denial of Service condition.
There is no known workaround at this time.
All libTIFF 4.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.2-r1"
All libTIFF 3.9 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.9.5-r2"
Multiple boundary checking vulnerabilities in libTIFF may allow for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.8.2-r8 | >= 3.8.2-r8 |
libTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Two vulnerabilities have been reported in libTIFF:
A remote attacker could entice a user to open a specially crafted TIFF file with an application making use of libTIFF or the tiff2rgba and rgb2ycbcr tools, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.2-r8"
Multiple buffer underflow vulnerabilities in libTIFF may allow for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.8.2-r4 | >= 3.8.2-r4 |
libTIFF provides support for reading and manipulating TIFF (Tagged Image File Format) images.
Drew Yao (Apple Product Security) and Clay Wood reported multiple buffer underflows in the LZWDecode() and LZWDecodeCompat() functions in tif_lzw.c when processing TIFF files.
A remote attacker could entice a user to open a specially crafted TIFF file with an application making use of libTIFF, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.2-r4"
libTIFF contains several vulnerabilities that could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.8.2-r2 | >= 3.8.2-r2 |
libTIFF provides support for reading and manipulating TIFF images.
Tavis Ormandy of the Google Security Team discovered several heap and stack buffer overflows and other flaws in libTIFF. The affected parts include the TIFFFetchShortPair(), TIFFScanLineSize() and EstimateStripByteCounts() functions, and the PixarLog and NeXT RLE decoders.
A remote attacker could entice a user to open a specially crafted TIFF file, resulting in the possible execution of arbitrary code.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.2-r2"
libTIFF contains buffer overflows that could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.8.2-r1 | >= 3.8.2-r1 |
libTIFF provides support for reading and manipulating TIFF images.
A buffer overflow has been found in the t2p_write_pdf_string function in tiff2pdf, which can been triggered with a TIFF file containing a DocumentName tag with UTF-8 characters. An additional buffer overflow has been found in the handling of the parameters in tiffsplit.
A remote attacker could entice a user to load a specially crafted TIFF file, resulting in the possible execution of arbitrary code.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.2-r1"
Multiple vulnerabilities in libTIFF could lead to the execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.8.1 | >= 3.8.1 |
libTIFF provides support for reading and manipulating TIFF images.
Multiple vulnerabilities, ranging from integer overflows and NULL pointer dereferences to double frees, were reported in libTIFF.
An attacker could exploit these vulnerabilities by enticing a user to open a specially crafted TIFF image, possibly leading to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.1"
The libTIFF library is vulnerable to a buffer overflow, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.7.2 | >= 3.7.2 |
libTIFF provides support for reading and manipulating TIFF (Tag Image File Format) images.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a stack based buffer overflow in the libTIFF library when reading a TIFF image with a malformed BitsPerSample tag.
Successful exploitation would require the victim to open a specially crafted TIFF image, resulting in the execution of arbitrary code.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.7.2"
An integer overflow has been found in the TIFF library image decoding routines and the tiffdump utility, potentially allowing arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/tiff | * | < 3.7.1-r1 | >= 3.7.1-r1 |
The TIFF library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE applications, to interpret TIFF images.
infamous41md found a potential integer overflow in the directory entry count routines of the TIFF library (CAN-2004-1308). Dmitry V. Levin found another similar issue in the tiffdump utility (CAN-2004-1183).
A remote attacker could entice a user to view a carefully crafted TIFF image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the TIFF library, including many web browsers or mail readers.
There is no known workaround at this time.
All TIFF library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/tiff-3.7.1-r1"
Multiple heap-based overflows have been found in the tiff library image decoding routines, potentially allowing to execute arbitrary code with the rights of the user viewing a malicious image.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/xv | * | <= 3.10a-r7 | >= 3.10a-r8 |
| media-libs/tiff | * | < 3.6.1-r2 | >= 3.6.1-r2 |
The tiff library contains encoding and decoding routines for the Tag Image File Format. It is called by numerous programs, including GNOME and KDE, to help in displaying TIFF images. xv is a multi-format image manipulation utility that is statically linked to the tiff library.
Chris Evans found heap-based overflows in RLE decoding routines in tif_next.c, tif_thunder.c and potentially tif_luv.c.
A remote attacker could entice a user to view a carefully crafted TIFF image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the tiff library, including GNOME and KDE web browsers or mail readers.
There is no known workaround at this time.
All tiff library users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/tiff-3.6.1-r2" # emerge ">=media-libs/tiff-3.6.1-r2"
xv makes use of the tiff library and needs to be recompiled to receive the new patched version of the library. All xv users should also upgrade to the latest version:
# emerge sync # emerge -pv ">=media-gfx/xv-3.10a-r8" # emerge ">=media-gfx/xv-3.10a-r8"