National Cyber Awareness System

Vulnerability Summary for CVE-2006-2025

Overview

Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

Solution

This vulnerability is addressed in the following product release: libTIFF, libTIFF, 3.8.1}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933

Type: Patch Information; Exploit

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189933

External Source: MISC

Name: http://bugzilla.remotesensing.org/show_bug.cgi?id=1102

Type: Patch Information; Exploit

Hyperlink:http://bugzilla.remotesensing.org/show_bug.cgi?id=1102

External Source: VUPEN

Name: ADV-2006-1563

Hyperlink:http://www.vupen.com/english/advisories/2006/1563

External Source: OVAL

Name: oval:org.mitre.oval:def:10593

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10593

External Source: XF

Name: libtiff-tifffetchdata-overflow(26134)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26134

External Source: UBUNTU

Name: USN-277-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-277-1

External Source: TRUSTIX

Name: 2006-0024

Hyperlink:http://www.trustix.org/errata/2006/0024

External Source: BID

Name: 17732

Hyperlink:http://www.securityfocus.com/bid/17732

External Source: REDHAT

Name: RHSA-2006:0425

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0425.html

External Source: SUSE

Name: SUSE-SR:2006:009

Hyperlink:http://www.novell.com/linux/security/advisories/2006_04_28.html

External Source: MANDRIVA

Name: MDKSA-2006:082

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:082

External Source: GENTOO

Name: GLSA-200605-17

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200605-17.xml

External Source: DEBIAN

Name: DSA-1054

Hyperlink:http://www.debian.org/security/2006/dsa-1054

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-119.htm

External Source: SUNALERT

Name: 201332

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201332-1

External Source: SUNALERT

Name: 103099

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103099-1

External Source: SECUNIA

Name: 20667

Hyperlink:http://secunia.com/advisories/20667

External Source: SECUNIA

Name: 20345

Hyperlink:http://secunia.com/advisories/20345

External Source: SECUNIA

Name: 20210

Hyperlink:http://secunia.com/advisories/20210

External Source: SECUNIA

Name: 20023

Hyperlink:http://secunia.com/advisories/20023

External Source: SECUNIA

Name: 20021

Hyperlink:http://secunia.com/advisories/20021

External Source: SECUNIA

Name: 19964

Hyperlink:http://secunia.com/advisories/19964

External Source: SECUNIA

Name: 19949

Hyperlink:http://secunia.com/advisories/19949

External Source: SECUNIA

Name: 19936

Hyperlink:http://secunia.com/advisories/19936

External Source: SECUNIA

Name: 19897

Hyperlink:http://secunia.com/advisories/19897

External Source: SECUNIA

Name: 19838

Hyperlink:http://secunia.com/advisories/19838

External Source: SGI

Name: 20060501-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:10593

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10593