CVE-2011-0192

NameCVE-2011-0192
DescriptionBuffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2210-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tiff (PTS)bullseye4.2.0-1+deb11u5fixed
bullseye (security)4.2.0-1+deb11u8fixed
bookworm4.5.0-6+deb12u3fixed
bookworm (security)4.5.0-6+deb12u4fixed
trixie4.7.0-3+deb13u1fixed
trixie (security)4.7.0-3+deb13u2fixed
forky, sid4.7.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tiffsourcelenny3.8.2-11.4DSA-2210-1
tiffsourcesqueeze3.9.4-5+squeeze1DSA-2210-1
tiffsource(unstable)3.9.4-7
tiff3source(unstable)(not affected)

Notes

- tiff3 <not-affected> (fixed before initial upload)
Search for package or bug name: Reporting problems