Heap-based buffer overflow in LibTIFF - CVE-2011-1167
Published: March 28, 2011 / Updated: May 21, 2022
Vulnerability identifier: #VU45158
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-1167
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier. A remote attacker can use crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
LibTIFF
Ubuntu
libtiff4 (Ubuntu package)
Ubuntu
libtiff4 (Ubuntu package)
How to mitigate CVE-2011-1167
Install update from vendor's website.
LibTIFF - update to 3.9.5
libtiff4 (Ubuntu package) - addressed in versions 3.7.4-1ubuntu3.11, 3.8.2-7ubuntu3.9, 3.8.2-13ubuntu0.6, 3.9.2-2ubuntu0.6, 3.9.4-2ubuntu0.3
libtiff4 (Ubuntu package) - addressed in versions 3.7.4-1ubuntu3.11, 3.8.2-7ubuntu3.9, 3.8.2-13ubuntu0.6, 3.9.2-2ubuntu0.6, 3.9.4-2ubuntu0.3
External References
- http://blackberry.com/btsc/KB27244
- http://bugzilla.maptools.org/show_bug.cgi?id=2300
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057763.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057840.html
- http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
- http://secunia.com/advisories/43900
- http://secunia.com/advisories/43934
- http://secunia.com/advisories/43974
- http://secunia.com/advisories/44117
- http://secunia.com/advisories/44135
- http://secunia.com/advisories/50726
- http://security.gentoo.org/glsa/glsa-201209-02.xml
- http://securityreason.com/securityalert/8165
- http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.587820
- http://support.apple.com/kb/HT5130
- http://support.apple.com/kb/HT5281
- http://support.apple.com/kb/HT5503
- http://ubuntu.com/usn/usn-1102-1
- http://www.debian.org/security/2011/dsa-2210
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
- http://www.osvdb.org/71256
- http://www.redhat.com/support/errata/RHSA-2011-0392.html
- http://www.securityfocus.com/archive/1/517101/100/0/threaded
- http://www.securityfocus.com/bid/46951
- http://www.securitytracker.com/id?1025257
- http://www.vupen.com/english/advisories/2011/0795
- http://www.vupen.com/english/advisories/2011/0845
- http://www.vupen.com/english/advisories/2011/0859
- http://www.vupen.com/english/advisories/2011/0860
- http://www.vupen.com/english/advisories/2011/0905
- http://www.vupen.com/english/advisories/2011/0930
- http://www.vupen.com/english/advisories/2011/0960
- http://www.zerodayinitiative.com/advisories/ZDI-11-107
- https://bugzilla.redhat.com/show_bug.cgi?id=684939
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66247