CVE-2011-0192

NameCVE-2011-0192
DescriptionBuffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2210-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tiff (PTS)stretch (security), stretch4.0.8-2+deb9u5fixed
buster, buster (security)4.1.0+git191117-2~deb10u1fixed
bullseye, sid4.1.0+git191117-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tiffsourcelenny3.8.2-11.4DSA-2210-1
tiffsourcesqueeze3.9.4-5+squeeze1DSA-2210-1
tiffsource(unstable)3.9.4-7
tiff3source(unstable)(not affected)

Notes

- tiff3 <not-affected> (fixed before initial upload)

Search for package or bug name: Reporting problems