CVE - CVE-2011-1167

CVE-ID
CVE-2011-1167	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1025257 URL:http://www.securitytracker.com/id?1025257 MISC:20110321 ZDI-11-107: Libtiff ThunderCode Decoder THUNDER_2BITDELTAS Remote Code Execution Vulnerability URL:http://www.securityfocus.com/archive/1/517101/100/0/threaded MISC:43900 URL:http://secunia.com/advisories/43900 MISC:43934 URL:http://secunia.com/advisories/43934 MISC:43974 URL:http://secunia.com/advisories/43974 MISC:44117 URL:http://secunia.com/advisories/44117 MISC:44135 URL:http://secunia.com/advisories/44135 MISC:46951 URL:http://www.securityfocus.com/bid/46951 MISC:50726 URL:http://secunia.com/advisories/50726 MISC:71256 URL:~~http://www.osvdb.org/71256~~ (Obsolete source) MISC:8165 URL:http://securityreason.com/securityalert/8165 MISC:ADV-2011-0795 URL:~~http://www.vupen.com/english/advisories/2011/0795~~ (Obsolete source) MISC:ADV-2011-0845 URL:~~http://www.vupen.com/english/advisories/2011/0845~~ (Obsolete source) MISC:ADV-2011-0859 URL:~~http://www.vupen.com/english/advisories/2011/0859~~ (Obsolete source) MISC:ADV-2011-0860 URL:~~http://www.vupen.com/english/advisories/2011/0860~~ (Obsolete source) MISC:ADV-2011-0905 URL:~~http://www.vupen.com/english/advisories/2011/0905~~ (Obsolete source) MISC:ADV-2011-0930 URL:~~http://www.vupen.com/english/advisories/2011/0930~~ (Obsolete source) MISC:ADV-2011-0960 URL:~~http://www.vupen.com/english/advisories/2011/0960~~ (Obsolete source) MISC:APPLE-SA-2012-02-01-1 URL:http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html MISC:APPLE-SA-2012-05-09-1 URL:http://lists.apple.com/archives/security-announce/2012/May/msg00001.html MISC:APPLE-SA-2012-09-19-1 URL:http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html MISC:DSA-2210 URL:http://www.debian.org/security/2011/dsa-2210 MISC:FEDORA-2011-3827 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057840.html MISC:FEDORA-2011-3836 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057763.html MISC:GLSA-201209-02 URL:http://security.gentoo.org/glsa/glsa-201209-02.xml MISC:MDVSA-2011:064 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2011:064~~ (Obsolete source) MISC:RHSA-2011:0392 URL:http://www.redhat.com/support/errata/RHSA-2011-0392.html MISC:SSA:2011-098-01 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.587820 MISC:SUSE-SR:2011:009 URL:http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html MISC:USN-1102-1 URL:http://ubuntu.com/usn/usn-1102-1 MISC:http://blackberry.com/btsc/KB27244 URL:http://blackberry.com/btsc/KB27244 MISC:http://bugzilla.maptools.org/show_bug.cgi?id=2300 URL:http://bugzilla.maptools.org/show_bug.cgi?id=2300 MISC:http://support.apple.com/kb/HT5130 URL:http://support.apple.com/kb/HT5130 MISC:http://support.apple.com/kb/HT5281 URL:http://support.apple.com/kb/HT5281 MISC:http://support.apple.com/kb/HT5503 URL:http://support.apple.com/kb/HT5503 MISC:http://www.zerodayinitiative.com/advisories/ZDI-11-107 URL:http://www.zerodayinitiative.com/advisories/ZDI-11-107 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=684939 URL:https://bugzilla.redhat.com/show_bug.cgi?id=684939 MISC:libtiff-thundercode-decoder-bo(66247) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/66247
Assigning CNA
Red Hat, Inc.
Date Record Created
20110303	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110303)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)