Description
Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 3.9.4-7 | — |
| Debian 13 | tiff | 3.9.4-7 | — |
| Debian 12 | tiff | 3.9.4-7 | — |
| Debian 6.0 | tiff | 3.9.4-5+squeeze1 | DSA-2210-1 |
| Debian 5.0 | tiff | 3.8.2-11.4 | DSA-2210-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libtiff +2 | 3.9.4-1.el6_0.1 | RHSA-2011:0318 |
| RHEL 5 | libtiff +1 | 3.8.2-7.el5_6.6 | RHSA-2011:0318 |
| RHEL 4 | libtiff +1 | 3.6.1-17.el4 | RHSA-2011:0318 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.0.7-1.1 | openSUSE-SU-2024:10554-1 |
Advisories 3
- RHSA-2011:0318 Red Hat Security Advisory: libtiff security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2210-1 tiff - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10554-1 libtiff-devel-32bit-4.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2011-0845 vdb-entry
- http://support.apple.com/kb/HT4564
- SUSE-SR:2011:009 vendor-advisory
- http://support.apple.com/kb/HT4565
- ADV-2011-0599 vdb-entry
- SSA:2011-098-01 vendor-advisory
- 46658 vdb-entry
- APPLE-SA-2011-10-12-1 vendor-advisory
- 43934 third-party-advisory
- FEDORA-2011-2498 vendor-advisory
- http://support.apple.com/kb/HT4566
- FEDORA-2011-3836 vendor-advisory
- ADV-2011-0621 vdb-entry
- ADV-2011-0905 vdb-entry
- DSA-2210 vendor-advisory
- APPLE-SA-2011-03-21-1 vendor-advisory
- SUSE-SR:2011:005 vendor-advisory
- http://blackberry.com/btsc/KB27244
- RHSA-2011:0318 vendor-advisory
- APPLE-SA-2011-03-02-1 vendor-advisory
- 43664 third-party-advisory
- ADV-2011-0551 vdb-entry
- GLSA-201209-02 vendor-advisory
- APPLE-SA-2011-03-09-1 vendor-advisory
- ADV-2011-0930 vdb-entry
- http://support.apple.com/kb/HT4999
- https://bugzilla.redhat.com/show_bug.cgi?id=678635
- 1025153 vdb-entry
- http://support.apple.com/kb/HT5001
- http://support.apple.com/kb/HT4554
- APPLE-SA-2011-03-09-2 vendor-advisory
- 44135 third-party-advisory
- ADV-2011-0960 vdb-entry
- 43585 third-party-advisory
- APPLE-SA-2011-03-09-3 vendor-advisory
- 44117 third-party-advisory
- APPLE-SA-2011-10-12-2 vendor-advisory
- MDVSA-2011:043 vendor-advisory
- 43593 third-party-advisory
- FEDORA-2011-3827 vendor-advisory
- FEDORA-2011-2540 vendor-advisory
- 50726 third-party-advisory
- http://support.apple.com/kb/HT4581