Name | CVE-2006-2656 |
Description | Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
References | DSA-1091-1 |
Debian Bugs | 369819 |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
tiff (PTS) | jessie, jessie (lts) | 4.0.3-12.3+deb8u16 | fixed |
stretch (security) | 4.0.8-2+deb9u8 | fixed | |
stretch (lts), stretch | 4.0.8-2+deb9u11 | fixed | |
buster | 4.1.0+git191117-2~deb10u4 | fixed | |
buster (security) | 4.1.0+git191117-2~deb10u9 | fixed | |
bullseye (security), bullseye | 4.2.0-1+deb11u5 | fixed | |
bookworm (security), bookworm | 4.5.0-6+deb12u1 | fixed | |
sid, trixie | 4.5.1+git230720-4 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
tiff | source | woody | 3.5.5-7woody2 | DSA-1091-1 | ||
tiff | source | sarge | 3.7.2-5 | DSA-1091-1 | ||
tiff | source | (unstable) | 3.8.2-3 | low | 369819 | |
tiff3 | source | (unstable) | (not affected) |
- tiff3 <not-affected> (fixed prior to initial upload)