This service will be undergoing maintenance at 00:00 UTC, 2016-09-28. It is expected to last about 1 hours

Bug 695885 (CVE-2009-5022)

Summary: CVE-2009-5022 libtiff ojpeg buffer overflow
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: mjc, rcvalle, tgl
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20090209,reported=20110412,source=internet,impact=important,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,rhel-6/libtiff=affected/cvss2=7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P,rhel-5/libtiff=notaffected,rhel-4/libtiff=notaffected,fedora-all/libtiff=affected,cwe=CWE-228->CWE-119
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-07-13 11:33:32 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 696143, 696144, 696204, 836126    
Bug Blocks:    

Description Josh Bressers 2011-04-12 17:14:23 EDT
The libtiff OJPEG decoder contains a heap buffer overflow when decoding
certain malformed data.

This was made known via the upstream 3.9.5 announcement. The bug is quite
old.

upstream bug:
http://bugzilla.maptools.org/show_bug.cgi?id=1999
Comment 1 Josh Bressers 2011-04-12 17:15:38 EDT
Statement:

This flaw did not affect libtiff as shipped in Red Hat Enterprise Linux 4 or 5. The OJPEG decoder is disabled in those distributions.
Comment 3 Josh Bressers 2011-04-13 10:41:14 EDT
Created libtiff tracking bugs for this issue

Affects: fedora-all [bug 696204]
Comment 4 errata-xmlrpc 2011-04-18 11:49:29 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0452 https://rhn.redhat.com/errata/RHSA-2011-0452.html