CVE-2011-0191

NameCVE-2011-0191
DescriptionBuffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2210-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tiff (PTS)bullseye4.2.0-1+deb11u5fixed
bullseye (security)4.2.0-1+deb11u8fixed
bookworm4.5.0-6+deb12u3fixed
bookworm (security)4.5.0-6+deb12u4fixed
trixie4.7.0-3+deb13u1fixed
trixie (security)4.7.0-3+deb13u2fixed
forky, sid4.7.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tiffsourcelenny3.8.2-11.4DSA-2210-1
tiffsourcesqueeze3.9.4-5+squeeze1DSA-2210-1
tiffsource(unstable)3.9.4-1
tiff3source(unstable)(not affected)

Notes

- tiff3 <not-affected> (fixed before initial upload)
This might've been fixed earlier even
Search for package or bug name: Reporting problems