National Cyber Awareness System

Vulnerability Summary for CVE-2006-2024

Overview

Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

Solution

This vulnerability is addressed in the following product release: libTIFF, libTIFF, 3.8.1}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933

External Source: VUPEN

Name: ADV-2006-1563

Hyperlink:http://www.vupen.com/english/advisories/2006/1563

External Source: OVAL

Name: oval:org.mitre.oval:def:9893

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9893

External Source: MISC

Name: http://bugzilla.remotesensing.org/show_bug.cgi?id=1102

Hyperlink:http://bugzilla.remotesensing.org/show_bug.cgi?id=1102

External Source: XF

Name: libtiff-tifffetchanyarray-dos(26133)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26133

External Source: UBUNTU

Name: USN-277-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-277-1

External Source: TRUSTIX

Name: 2006-0024

Hyperlink:http://www.trustix.org/errata/2006/0024

External Source: BID

Name: 17730

Hyperlink:http://www.securityfocus.com/bid/17730

External Source: REDHAT

Name: RHSA-2006:0425

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0425.html

External Source: SUSE

Name: SUSE-SR:2006:009

Hyperlink:http://www.novell.com/linux/security/advisories/2006_04_28.html

External Source: MANDRIVA

Name: MDKSA-2006:082

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:082

External Source: GENTOO

Name: GLSA-200605-17

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200605-17.xml

External Source: DEBIAN

Name: DSA-1054

Hyperlink:http://www.debian.org/security/2006/dsa-1054

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm

External Source: SUNALERT

Name: 201332

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201332-1

External Source: SUNALERT

Name: 103099

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103099-1

External Source: SECUNIA

Name: 20667

Hyperlink:http://secunia.com/advisories/20667

External Source: SECUNIA

Name: 20345

Hyperlink:http://secunia.com/advisories/20345

External Source: SECUNIA

Name: 20210

Hyperlink:http://secunia.com/advisories/20210

External Source: SECUNIA

Name: 20023

Hyperlink:http://secunia.com/advisories/20023

External Source: SECUNIA

Name: 20021

Hyperlink:http://secunia.com/advisories/20021

External Source: SECUNIA

Name: 19964

Hyperlink:http://secunia.com/advisories/19964

External Source: SECUNIA

Name: 19949

Hyperlink:http://secunia.com/advisories/19949

External Source: SECUNIA

Name: 19936

Hyperlink:http://secunia.com/advisories/19936

External Source: SECUNIA

Name: 19897

Hyperlink:http://secunia.com/advisories/19897

External Source: SECUNIA

Name: 19851

Hyperlink:http://secunia.com/advisories/19851

External Source: SECUNIA

Name: 19838

Hyperlink:http://secunia.com/advisories/19838

External Source: SGI

Name: 20060501-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:9893

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9893