[SECURITY] Fedora Core 2 Update: libtiff-3.5.7-20.2

[Matthias Clasen]

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-334
2004-10-14
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : libtiff
Version     : 3.5.7                      
Release     : 20.2                  
Summary     : A library of functions for manipulating TIFF format image
files.
Description :
The libtiff package contains a library of functions for manipulating
TIFF (Tagged Image File Format) image format files.  TIFF is a widely
used file format for bitmapped images.  TIFF files usually end in the
.tif extension and they are often quite large.

The libtiff package should be installed if you need to manipulate TIFF
format image files.

---------------------------------------------------------------------
Update Information:

The libtiff package contains a library of functions for manipulating
TIFF
(Tagged Image File Format) image format files. TIFF is a widely used
file
format for bitmapped images.

During a source code audit, Chris Evans discovered a number of integer
overflow bugs that affect libtiff. An attacker who has the ability to
trick
a user into opening a malicious TIFF file could cause the application
linked to libtiff to crash or possibly execute arbitrary code. The
Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0886 to this issue.

Additionally, a number of buffer overflow bugs that affect libtiff have
been found. An attacker who has the ability to trick a user into opening
a
malicious TIFF file could cause the application linked to libtiff to
crash
or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0803 to
this issue.

All users are advised to upgrade to these errata packages, which contain
fixes for these issues. 
---------------------------------------------------------------------
* Thu Oct 07 2004 Matthias Clasen <mclasen at redhat.com>

- fix some integer and buffer overflows (#134853, #134848)


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

176b76f644d44964a485e71ea09c814b  SRPMS/libtiff-3.5.7-20.2.src.rpm
a53252dfa36355bc7afb44f68de3534f  x86_64/libtiff-3.5.7-20.2.x86_64.rpm
72f0b77f45916d20a8517d7cf9b80e1d 
x86_64/libtiff-devel-3.5.7-20.2.x86_64.rpm
7b17b8e556b04850231efef0e38bf582 
x86_64/debug/libtiff-debuginfo-3.5.7-20.2.x86_64.rpm
f86f0dec436740a312ad310140a3d537  x86_64/libtiff-3.5.7-20.2.i386.rpm
f86f0dec436740a312ad310140a3d537  i386/libtiff-3.5.7-20.2.i386.rpm
d78da339e6ac75c8bad8d6c87ca8c232  i386/libtiff-devel-3.5.7-20.2.i386.rpm
fcb92220b830cce1c65a844d52e6d07d 
i386/debug/libtiff-debuginfo-3.5.7-20.2.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------