Aviso de seguridad de Debian

DSA-1091-1 tiff -- desbordamientos de buffer

Fecha del informe:

8 de jun de 2006

Paquetes afectados:

Vulnerable:

Sí

Referencias a bases de datos de seguridad:

En el sistema de seguimiento de errores de Debian: error 369819.
En el diccionario CVE de Mitre: CVE-2006-2656, CVE-2006-2193.

Información adicional:

Se han descubierto varios problemas de seguridad en la biblioteca TIFF. El proyecto Common Vulnerabilities and Exposures identifica las siguientes incidencias:

CVE-2006-2193
SuSE descubrió un desbordamiento de buffer en la conversión de archivos TIFF a documentos PDF, del que se podía sacar provecho, por ejemplo, cuando se utilizaba tiff2pdf en un filtro de impresión.
CVE-2006-2656
La orden tiffsplit, de la biblioteca TIFF, contenía un desbordamiento de buffer en la gestión de la línea de órdenes, del que se podía sacar provecho cuando el programa se ejecutaba automáticamente con nombres de archivos desconocidos.

Para la distribución estable anterior (woody), este problema se ha corregido en la versión 3.5.5-7woody2.

Para la distribución estable (sarge), este problema se ha corregido en la versión 3.7.2-5.

Para la distribución inestable (sid), este problema se ha corregido en la versión 3.8.2-4.

Le recomendamos que actualice los paquetes de tiff.

Arreglado en:

Debian GNU/Linux 3.0 (woody)

Fuentes:: http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-7woody2.dsc; http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5-7woody2.diff.gz; http://security.debian.org/pool/updates/main/t/tiff/tiff_3.5.5.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.5.5-7woody2_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g_3.5.5-7woody2_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff3g-dev_3.5.5-7woody2_sparc.deb

Debian GNU/Linux 3.1 (sarge)

Fuentes:: http://security.debian.org/pool/updates/main/t/tiff/tiff_3.7.2-5.dsc; http://security.debian.org/pool/updates/main/t/tiff/tiff_3.7.2-5.diff.gz; http://security.debian.org/pool/updates/main/t/tiff/tiff_3.7.2.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_alpha.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_amd64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_amd64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_amd64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_amd64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_arm.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_i386.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_ia64.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_hppa.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_m68k.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_mips.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_mipsel.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_powerpc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_s390.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.7.2-5_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.7.2-5_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.7.2-5_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.7.2-5_sparc.deb; http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0_3.7.2-5_sparc.deb

Las sumas MD5 de los ficheros que se listan están disponibles en el aviso original.