Package: libtk-img Severity: important Tags: security I have been working on a tool called Clonewise to automatically identify embedded code copies in Debian packages and determine if they are out of date and vulnerable. Ideally, embedding code and libraries should be avoided and a system wide library should be used instead.
I recently ran the tool on Debian 6 stable. The results are here at http://www.foocodechu.com/downloads/Clonewise-report.txt* *The libtk-img package reported potential issues appended to this message. The analysis tries to justify why it believes a library or code is embedded in the package and if the relationship is not already being tracked by Debian in the embedded-code-copies database it shows the files that are shared between the two pieces of software. Apologies if these are false positives. Your help in advising me on whether these issues are real will help me improve the analysis for the future. -- Silvio Cesare Deakin University ### Summary: ### tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2010-2597 tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2010-4665 tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2011-1167 ### Reports by package: ### # Package libtk-img may be vulnerable to the following issues: # CVE-2010-2597 CVE-2010-4665 CVE-2011-1167 # SUMMARY: The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error. # # CVE-2010-2597 relates to a vulnerability in package tiff. # The following source filenames are likely responsible: # tifstrip.c # # The following package clones are tracked in the embedded-code-copies # database. They have not been fixed. # tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2010-2597 # SUMMARY: Integer overflow in the ReadDirectory function in tiffdump.c in tiffdump in LibTIFF before 3.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF file containing a directory data structure with many directory entries. # # CVE-2010-4665 relates to a vulnerability in package tiff. # The following source filenames are likely responsible: # tiffdump.c # # The following package clones are tracked in the embedded-code-copies # database. They have not been fixed. # tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2010-4665 # SUMMARY: Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value. # # CVE-2011-1167 relates to a vulnerability in package tiff. # The following source filenames are likely responsible: # tifthunder.c # # The following package clones are tracked in the embedded-code-copies # database. They have not been fixed. # tiff CLONED_IN_SOURCE libtk-img <unfixed> CVE-2011-1167
