Return-Path: <tiff-bounces@lists.maptools.org>
X-Original-To: info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-r.b-one.net (mx-r.one.com [91.198.169.249])
	by mail9.b-one.net (Postfix) with ESMTP id AE97B400505
	for <info@awaresystems.be>; Mon, 21 Mar 2011 17:12:06 +0100 (CET)
Received: by mx-r.b-one.net (Postfix, from userid 106)
	id A072D5F54A51; Mon, 21 Mar 2011 17:12:06 +0100 (CET)
X-Virus-Scanned: by one.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level: 
X-Spam-Status: No, score=0 tagged_above=0 required=4 tests=[none]
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from lists.maptools.org (lists.maptools.org [65.39.174.144]) by
 mx-r.b-one.net (Postfix) with ESMTP id 7000DC5CA12 for
 <info@awaresystems.be>; Mon, 21 Mar 2011 17:12:04 +0100 (CET)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by
 lists.maptools.org (Postfix) with ESMTP id 0BAF486BFA; Mon, 21 Mar 2011
 11:10:31 -0500 (EST)
Received: from sasl.smtp.pobox.com (a-pb-sasl-sd.pobox.com [64.74.157.62]) by
 lists.maptools.org (Postfix) with ESMTP id A50078695A for
 <tiff@lists.maptools.org>; Mon, 21 Mar 2011 11:09:24 -0500 (EST)
Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by
 a-pb-sasl-sd.pobox.com (Postfix) with ESMTP id 1FA62440A; Mon, 21 Mar 2011
 12:11:02 -0400 (EDT)
Received: from a-pb-sasl-sd.pobox.com (unknown [127.0.0.1]) by
 a-pb-sasl-sd.pobox.com (Postfix) with ESMTP id E8C9E4409; Mon, 21 Mar 2011
 12:10:58 -0400 (EDT)
Received: from [192.168.2.24] (unknown [70.48.53.217]) (using TLSv1 with
 cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested)
 by a-pb-sasl-sd.pobox.com (Postfix) with ESMTPSA id 344814405; Mon, 21 Mar
 2011 12:10:56 -0400 (EDT)
Message-ID: <4D87782D.4020404@pobox.com>
Date: Mon, 21 Mar 2011 12:09:17 -0400
From: Frank Warmerdam <warmerdam@pobox.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.14)
 Gecko/20110223 Thunderbird/3.1.8
MIME-Version: 1.0
To: TIFF mailing list <tiff@lists.maptools.org>
X-Pobox-Relay-ID:
 CF15C87E-53D5-11E0-9939-E8AB60295C12-06493634!a-pb-sasl-sd.pobox.com
Cc: ZDI Disclosures <zdi-disclosures@tippingpoint.com>, vdanen@redhat.com
Subject: [Tiff] Thunder Decoder Vulnerability
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

Folks,

Thanks to a report from the Zero Day Initiative, there is a fix for a
buffer overflow problem in libtiff's thunder decoder.  Details are available
at:

   http://bugzilla.maptools.org/show_bug.cgi?id=2300

The libtiff development team would like to thank Marin Barbella and
TippingPoint's Zero Day Initiative for reporting this vulnerability
(ZDI-CAN-1004, CVE-2011-1167).

Best regards,
-- 
---------------------------------------+--------------------------------------
I set the clouds in motion - turn up   | Frank Warmerdam, warmerdam@pobox.com
light and sound - activate the windows | http://pobox.com/~warmerdam
and watch the world go round - Rush    | Geospatial Programmer for Rent

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
