| Description: | Summary:
The remote host is missing an update for the 'libtiff' package(s) announced via the SSA:2006-230-01 advisory.
Vulnerability Insight:
New libtiff packages are available for Slackware 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix security issues. These issues could be used
to crash programs linked to libtiff or possibly to execute code as the
program's user.
Thanks to Tavis Ormandy and the Google Security Team.
More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[links moved to references]
Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/libtiff-3.8.2-i486-1_slack10.2.tgz:
Patched vulnerabilities in libtiff which were found by Tavis Ormandy of
the Google Security Team. These issues could be used to crash programs
linked to libtiff or possibly to execute code as the program's user.
A low risk command-line overflow in tiffsplit was also patched.
For more details, see:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'libtiff' package(s) on Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1, Slackware 10.2, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
