CVE-2011-0192

CVE Details

Release Date:	2011-03-03
Impact:	Important	What is this?

Description

Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.

See more information about CVE-2011-0192 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	9.3
Vector String:	AV:N/AC:M/Au:N/C:C/I:C/A:C
Version:	2.0
Attack Vector:	Network
Attack Complexity:	Medium
Authentication:	None
Confidentiality Impact:	Complete
Integrity Impact:	Complete
Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 4 (libtiff)	ELSA-2011-0318	2011-03-03
Oracle Linux version 5 (libtiff)	ELSA-2011-0318	2011-03-03
Oracle Linux version 6 (libtiff)	ELSA-2011-0318	2011-03-03