CVE-2009-3296

NameCVE-2009-3296
DescriptionMultiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1912-1, DSA-1912-2
NVD severityhigh (attack range: remote)
Debian Bugs551282

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
advi (PTS)wheezy1.10.2-1+deb7u1fixed
jessie1.10.2-2fixed
buster, sid, stretch1.10.2-3fixed
camlimages (PTS)wheezy1:4.0.1-4fixed
jessie1:4.0.1-8fixed
buster, sid, stretch1:4.2.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
advisource(unstable)1.6.0-15low551282
advisourceetch1.6.0-12+etch2highDSA-1912-2
advisourcelenny1.6.0-13+lenny2highDSA-1912-2
camlimagessource(unstable)1:3.0.1-5low
camlimagessourceetch2.20-8+etch3highDSA-1912-1
camlimagessourcelenny1:2.2.0-4+lenny3highDSA-1912-1

Search for package or bug name: Reporting problems