Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2598 to the following vulnerability: LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input." References (in MITRE CVE description): [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2598 [2] https://bugzilla.redhat.com/show_bug.cgi?id=583081 Further references: [3] http://bugzilla.maptools.org/show_bug.cgi?id=2207 [4] https://bugzilla.redhat.com/show_bug.cgi?id=583081#c14
This issue affects the versions of the libtiff package, as shipped with Red Hat Enterprise Linux 3, 4, and 5. -- This issue does NOT affect the current versions of the libtiff and mingw32-libtiff packages, as shipped with Fedora releases of 12 and 13 (this flaw has been already addressed in those versions).
Actually the problem is not at all specific to 64-bit platforms, though possibly specific manifestations of it might be.
Tom, thank you for clarification. (In reply to comment #1) > This issue affects the versions of the libtiff package, as shipped > with Red Hat Enterprise Linux 3, 4, and 5. Hence this needs to be correct to: This only affected libtiff in Red Hat Enterprise Linux 3. libtiff versions in Red Hat Enterprise Linux 4 and later are based on upstream version that stops reading image that does not have compression method configured.
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Via RHSA-2010:0520 https://rhn.redhat.com/errata/RHSA-2010-0520.html