A local overflow exists in LibTIFF. The PixarLog decoder fails to validate TIFF image files resulting in a heap overflow. With a specially crafted file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Upgrade to version 3.8.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Bugtraq ID: 19290
• CVE ID: 2006-3461 (see also: NVD)
• Secunia Advisory ID: 21253 21274 21290 21304 21319 21334 21338 21370 21392 21501 21537 21598 21632 22036 27181 27222 27832
• Related OSVDB ID: 27723 27724 27726 27727 27728 27729
• Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P.asc ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc http://docs.info.apple.com/article.html?artnum=304063
  http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm
  http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml
• Other Advisory URL: http://lists.suse.com/archive/suse-security-announce/2006-Aug/0001.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-103099-1
  http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1
  http://www.mandriva.com/security/advisories?name=MDKSA-2006:137
  http://www.ubuntu.com/usn/usn-330-1
  http://www.us.debian.org/security/2006/dsa-1137
  https://issues.rpath.com/browse/RPL-558
• Vendor URL: http://www.libtiff.org/
• Vendor Specific News/Changelog Entry: https://bugs.gentoo.org/show_bug.cgi?id=142383
• RedHat RHSA: RHSA-2006:0603 RHSA-2006:0648

• Tavis Ormandy - tavisogoogle.com - Google Information Security Team