CVE-2011-0192: Buffer Overflow
A heap-based buffer overflow was found in the way TIFF (Tagged Image File Format) image files manipulating library expanded certain rows of 2D-encoded data, when processing TIFF Internet Fax image files, compressed with CCITT group 4 compression algorithm. If an attacker created a specially-crafted image file and tricked a local, unsuspecting user into loading the image file in an application that uses the TIFF image manipulating library, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
Other sources
Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tiffax3.h. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0192?
CVE-2011-0192 is classified as a critical vulnerability due to the potential for remote code execution through specially crafted TIFF files.
How do I fix CVE-2011-0192?
To mitigate CVE-2011-0192, users should update to the latest version of Apple iTunes that addresses this vulnerability.
What type of vulnerability is CVE-2011-0192?
CVE-2011-0192 is a heap-based buffer overflow vulnerability affecting TIFF image file processing.
Which versions of Apple iTunes are affected by CVE-2011-0192?
CVE-2011-0192 affects multiple versions of Apple iTunes up to and including 10.1.2, as well as specific versions starting from 4.0.0.
Can CVE-2011-0192 affect Windows operating systems?
No, CVE-2011-0192 specifically impacts Apple iTunes on Mac systems and does not affect Microsoft Windows operating systems.