CVE-2010-2067

Upstream information

CVE-2010-2067 at MITRE

Description

Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tif_dirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long EXIF SubjectDistance field in a TIFF file.

---

SUSE information

CVSS v2 Scores

	National Vulnerability Database
Base Score	6.82
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

SUSE Bugzilla entries: 612787 [RESOLVED / FIXED], 612879 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SR:2010:014, published Mon, 02 Aug 2010 15:00:00 +0000
• openSUSE-SU-2010:0387-1, published Fri, 16 Jul 2010 15:08:09 +0200 (CEST)
• openSUSE-SU-2010:0420-1, published Thu, 22 Jul 2010 19:08:18 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 12	libtiff5 >= 4.0.3-9.78 libtiff5-32bit >= 4.0.3-9.78	Patchnames: SUSE Linux Enterprise Desktop 12 GA libtiff5-32bit
SUSE Linux Enterprise Desktop 12 SP1	libtiff5 >= 4.0.4-12.2 libtiff5-32bit >= 4.0.4-12.2	Patchnames: SUSE Linux Enterprise Desktop 12 SP1 GA libtiff5-32bit
SUSE Linux Enterprise Desktop 12 SP2	libtiff5 >= 4.0.6-26.3 libtiff5-32bit >= 4.0.6-26.3	Patchnames: SUSE Linux Enterprise Desktop 12 SP2 GA libtiff5-32bit
SUSE Linux Enterprise Server 12	libtiff5 >= 4.0.3-9.78 libtiff5-32bit >= 4.0.3-9.78 tiff >= 4.0.3-9.78	Patchnames: SUSE Linux Enterprise Server 12 GA libtiff5-32bit
SUSE Linux Enterprise Server 12 SP1	libtiff5 >= 4.0.4-12.2 libtiff5-32bit >= 4.0.4-12.2 tiff >= 4.0.4-12.2	Patchnames: SUSE Linux Enterprise Server 12 SP1 GA libtiff5-32bit
SUSE Linux Enterprise Server 12 SP2	libtiff5 >= 4.0.6-26.3 libtiff5-32bit >= 4.0.6-26.3 tiff >= 4.0.6-26.3	Patchnames: SUSE Linux Enterprise Server 12 SP2 GA libtiff5-32bit
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2	libtiff5 >= 4.0.6-26.3 tiff >= 4.0.6-26.3	Patchnames: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA libtiff5
SUSE Linux Enterprise Software Development Kit 12	libtiff-devel >= 4.0.3-9.78	Patchnames: SUSE Linux Enterprise Software Development Kit 12 GA libtiff-devel
SUSE Linux Enterprise Software Development Kit 12 SP1	libtiff-devel >= 4.0.4-12.2	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP1 GA libtiff-devel
SUSE Linux Enterprise Software Development Kit 12 SP2	libtiff-devel >= 4.0.6-26.3	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP2 GA libtiff-devel
openSUSE 11.3	tiff-debuginfo >= 3.9.2-5.1.1 tiff-debugsource >= 3.9.2-5.1.1
openSUSE 11.3	tiff >= 3.9.2-5.1.1
openSUSE 13.2	libtiff-devel >= 4.0.3-10.1.2 libtiff5 >= 4.0.3-10.1.2 libtiff5-32bit >= 4.0.3-10.1.2 tiff >= 4.0.3-10.1.2	Patchnames: openSUSE 13.2 GA libtiff-devel
openSUSE Leap 42.1	libtiff-devel >= 4.0.4-1.1 libtiff5 >= 4.0.4-1.1 libtiff5-32bit >= 4.0.4-1.1 tiff >= 4.0.4-1.1	Patchnames: openSUSE Leap 42.1 GA libtiff-devel
openSUSE Leap 42.2	libtiff-devel >= 4.0.6-10.1 libtiff5 >= 4.0.6-10.1 libtiff5-32bit >= 4.0.6-10.1 tiff >= 4.0.6-10.1	Patchnames: openSUSE Leap 42.2 GA libtiff-devel
openSUSE Tumbleweed	libtiff-devel >= 4.0.7-1.1 libtiff-devel-32bit >= 4.0.7-1.1 libtiff5 >= 4.0.7-1.1 libtiff5-32bit >= 4.0.7-1.1 tiff >= 4.0.7-1.1	Patchnames: openSUSE Tumbleweed GA libtiff-devel-32bit