NVD Vulnerability Detail

CVE-2011-0191

Summary	Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.
Publication Date	March 4, 2011, 5 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:23 a.m.

CVSS2.0 : HIGH
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:itunes::::::::			10.1.2
cpe:2.3:a:apple:itunes:4.0.0:::::::*
cpe:2.3:a:apple:itunes:4.0.1:::::::*
cpe:2.3:a:apple:itunes:4.1.0:::::::*
cpe:2.3:a:apple:itunes:4.2.0:::::::*
cpe:2.3:a:apple:itunes:4.5:::::::*
cpe:2.3:a:apple:itunes:4.5.0:::::::*
cpe:2.3:a:apple:itunes:4.6:::::::*
cpe:2.3:a:apple:itunes:4.6.0:::::::*
cpe:2.3:a:apple:itunes:4.7:::::::*
cpe:2.3:a:apple:itunes:4.7.0:::::::*
cpe:2.3:a:apple:itunes:4.7.1:::::::*
cpe:2.3:a:apple:itunes:4.7.2:::::::*
cpe:2.3:a:apple:itunes:4.8.0:::::::*
cpe:2.3:a:apple:itunes:4.9.0:::::::*
cpe:2.3:a:apple:itunes:5.0:::::::*
cpe:2.3:a:apple:itunes:5.0.0:::::::*
cpe:2.3:a:apple:itunes:5.0.1:::::::*
cpe:2.3:a:apple:itunes:6.0.0:::::::*
cpe:2.3:a:apple:itunes:6.0.1:::::::*
cpe:2.3:a:apple:itunes:6.0.2:::::::*
cpe:2.3:a:apple:itunes:6.0.3:::::::*
cpe:2.3:a:apple:itunes:6.0.4:::::::*
cpe:2.3:a:apple:itunes:6.0.4.2:::::::*
cpe:2.3:a:apple:itunes:6.0.5:::::::*
cpe:2.3:a:apple:itunes:7.0.0:::::::*
cpe:2.3:a:apple:itunes:7.0.1:::::::*
cpe:2.3:a:apple:itunes:7.0.2:::::::*
cpe:2.3:a:apple:itunes:7.1.0:::::::*
cpe:2.3:a:apple:itunes:7.1.1:::::::*
cpe:2.3:a:apple:itunes:7.2.0:::::::*
cpe:2.3:a:apple:itunes:7.3.0:::::::*
cpe:2.3:a:apple:itunes:7.3.1:::::::*
cpe:2.3:a:apple:itunes:7.3.2:::::::*
cpe:2.3:a:apple:itunes:7.4:::::::*
cpe:2.3:a:apple:itunes:7.4.0:::::::*
cpe:2.3:a:apple:itunes:7.4.1:::::::*
cpe:2.3:a:apple:itunes:7.4.2:::::::*
cpe:2.3:a:apple:itunes:7.4.3:::::::*
cpe:2.3:a:apple:itunes:7.5:::::::*
cpe:2.3:a:apple:itunes:7.5.0:::::::*
cpe:2.3:a:apple:itunes:7.6:::::::*
cpe:2.3:a:apple:itunes:7.6.0:::::::*
cpe:2.3:a:apple:itunes:7.6.1:::::::*
cpe:2.3:a:apple:itunes:7.6.2:::::::*
cpe:2.3:a:apple:itunes:7.7:::::::*
cpe:2.3:a:apple:itunes:7.7.0:::::::*
cpe:2.3:a:apple:itunes:7.7.1:::::::*
cpe:2.3:a:apple:itunes:8.0.0:::::::*
cpe:2.3:a:apple:itunes:8.0.1:::::::*
cpe:2.3:a:apple:itunes:8.0.2:::::::*
cpe:2.3:a:apple:itunes:8.1:::::::*
cpe:2.3:a:apple:itunes:8.1.1:::::::*
cpe:2.3:a:apple:itunes:8.2:::::::*
cpe:2.3:a:apple:itunes:8.2.1:::::::*
cpe:2.3:a:apple:itunes:9.0.0:::::::*
cpe:2.3:a:apple:itunes:9.0.1:::::::*
cpe:2.3:a:apple:itunes:9.0.2:::::::*
cpe:2.3:a:apple:itunes:9.0.3:::::::*
cpe:2.3:a:apple:itunes:9.2:::::::*
cpe:2.3:a:apple:itunes:9.2.1:::::::*
cpe:2.3:a:apple:itunes:10.0:::::::*
cpe:2.3:a:apple:itunes:10.0.1:::::::*
cpe:2.3:a:apple:itunes:10.1:::::::*
cpe:2.3:a:apple:itunes:10.1.1:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
4	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
5	cpe:2.3:o:microsoft:windows_vista::::::::
6	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
7	cpe:2.3:o:microsoft:windows_xp::sp3::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
2	http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
3	http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
4	http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html	Patch Vendor Advisory
5	http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
6	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
7	http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
8	http://secunia.com/advisories/43934
9	http://support.apple.com/kb/HT4554	Vendor Advisory
10	http://support.apple.com/kb/HT4564
11	http://support.apple.com/kb/HT4565
12	http://support.apple.com/kb/HT4566
13	http://support.apple.com/kb/HT4581
14	http://www.debian.org/security/2011/dsa-2210
15	http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
16	http://www.securityfocus.com/bid/46657
17	http://www.vupen.com/english/advisories/2011/0845
18	http://www.vupen.com/english/advisories/2011/0859
19	http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
20	http://www.vupen.com/english/advisories/2011/0859
21	http://www.vupen.com/english/advisories/2011/0845
22	http://www.securityfocus.com/bid/46657
23	http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
24	http://www.debian.org/security/2011/dsa-2210
25	http://support.apple.com/kb/HT4581
26	http://support.apple.com/kb/HT4566
27	http://support.apple.com/kb/HT4565
28	http://support.apple.com/kb/HT4564
29	http://support.apple.com/kb/HT4554	Vendor Advisory
30	http://secunia.com/advisories/43934
31	http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
32	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
33	http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
34	http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html	Patch Vendor Advisory
35	http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
36	http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

複数の Apple 製品の LibTIFF におけるバッファオーバーフローの脆弱性

Title	複数の Apple 製品の LibTIFF におけるバッファオーバーフローの脆弱性
Summary	複数の Apple 製品の LibTIFF にはバッファオーバーフローの脆弱性が存在します。
Possible impacts	攻撃者により、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 3, 2011, midnight
Registration Date	April 5, 2011, 2:46 p.m.
Last Update	April 5, 2011, 2:46 p.m.

Affected System

アップル

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6.5 以降

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6.5 以降

Apple TV 4.0

Apple TV 4.1

iOS 3.0 から 4.2.1 (iPhone 3GS 以降の場合)

iOS 3.1 から 4.2.1 (iPod touch (3rd generation)以降の場合)

iOS 3.2 から 4.2.1 (iPad 用)

iPad

iPhone

iPod touch

iTunes 10

Safari 5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0191	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0191
National Vulnerability Database (NVD)
2	CVE-2011-0191	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0191

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4554	http://support.apple.com/kb/HT4554
2	HT4564	http://support.apple.com/kb/HT4564
3	HT4565	http://support.apple.com/kb/HT4565
4	HT4566	http://support.apple.com/kb/HT4566
5	HT4581	http://support.apple.com/kb/HT4581
Apple セキュリティアップデート
6	HT4554	http://support.apple.com/kb/HT4554?viewlocale=ja_JP
7	HT4564	http://support.apple.com/kb/HT4564?viewlocale=ja_JP
8	HT4565	http://support.apple.com/kb/HT4565?viewlocale=ja_JP
9	HT4566	http://support.apple.com/kb/HT4566?viewlocale=ja_JP
10	HT4581	http://support.apple.com/kb/HT4581?viewlocale=ja_JP

その他

No	Name	URL
JVN
1	JVNVU#556020	http://jvn.jp/cert/JVNVU556020
2	JVNVU#574588	http://jvn.jp/cert/JVNVU574588
3	JVNVU#636925	http://jvn.jp/cert/JVNVU636925
4	JVNVU#643615	http://jvn.jp/cert/JVNVU643615
5	JVNVU#867452	http://jvn.jp/cert/JVNVU867452

Change Log

No	Changed Details	Date of change
0	[2011年04月05日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:itunes::::::::			10.1.2
cpe:2.3:a:apple:itunes:4.0.0:::::::*
cpe:2.3:a:apple:itunes:4.0.1:::::::*
cpe:2.3:a:apple:itunes:4.1.0:::::::*
cpe:2.3:a:apple:itunes:4.2.0:::::::*
cpe:2.3:a:apple:itunes:4.5:::::::*
cpe:2.3:a:apple:itunes:4.5.0:::::::*
cpe:2.3:a:apple:itunes:4.6:::::::*
cpe:2.3:a:apple:itunes:4.6.0:::::::*
cpe:2.3:a:apple:itunes:4.7:::::::*
cpe:2.3:a:apple:itunes:4.7.0:::::::*
cpe:2.3:a:apple:itunes:4.7.1:::::::*
cpe:2.3:a:apple:itunes:4.7.2:::::::*
cpe:2.3:a:apple:itunes:4.8.0:::::::*
cpe:2.3:a:apple:itunes:4.9.0:::::::*
cpe:2.3:a:apple:itunes:5.0:::::::*
cpe:2.3:a:apple:itunes:5.0.0:::::::*
cpe:2.3:a:apple:itunes:5.0.1:::::::*
cpe:2.3:a:apple:itunes:6.0.0:::::::*
cpe:2.3:a:apple:itunes:6.0.1:::::::*
cpe:2.3:a:apple:itunes:6.0.2:::::::*
cpe:2.3:a:apple:itunes:6.0.3:::::::*
cpe:2.3:a:apple:itunes:6.0.4:::::::*
cpe:2.3:a:apple:itunes:6.0.4.2:::::::*
cpe:2.3:a:apple:itunes:6.0.5:::::::*
cpe:2.3:a:apple:itunes:7.0.0:::::::*
cpe:2.3:a:apple:itunes:7.0.1:::::::*
cpe:2.3:a:apple:itunes:7.0.2:::::::*
cpe:2.3:a:apple:itunes:7.1.0:::::::*
cpe:2.3:a:apple:itunes:7.1.1:::::::*
cpe:2.3:a:apple:itunes:7.2.0:::::::*
cpe:2.3:a:apple:itunes:7.3.0:::::::*
cpe:2.3:a:apple:itunes:7.3.1:::::::*
cpe:2.3:a:apple:itunes:7.3.2:::::::*
cpe:2.3:a:apple:itunes:7.4:::::::*
cpe:2.3:a:apple:itunes:7.4.0:::::::*
cpe:2.3:a:apple:itunes:7.4.1:::::::*
cpe:2.3:a:apple:itunes:7.4.2:::::::*
cpe:2.3:a:apple:itunes:7.4.3:::::::*
cpe:2.3:a:apple:itunes:7.5:::::::*
cpe:2.3:a:apple:itunes:7.5.0:::::::*
cpe:2.3:a:apple:itunes:7.6:::::::*
cpe:2.3:a:apple:itunes:7.6.0:::::::*
cpe:2.3:a:apple:itunes:7.6.1:::::::*
cpe:2.3:a:apple:itunes:7.6.2:::::::*
cpe:2.3:a:apple:itunes:7.7:::::::*
cpe:2.3:a:apple:itunes:7.7.0:::::::*
cpe:2.3:a:apple:itunes:7.7.1:::::::*
cpe:2.3:a:apple:itunes:8.0.0:::::::*
cpe:2.3:a:apple:itunes:8.0.1:::::::*
cpe:2.3:a:apple:itunes:8.0.2:::::::*
cpe:2.3:a:apple:itunes:8.1:::::::*
cpe:2.3:a:apple:itunes:8.1.1:::::::*
cpe:2.3:a:apple:itunes:8.2:::::::*
cpe:2.3:a:apple:itunes:8.2.1:::::::*
cpe:2.3:a:apple:itunes:9.0.0:::::::*
cpe:2.3:a:apple:itunes:9.0.1:::::::*
cpe:2.3:a:apple:itunes:9.0.2:::::::*
cpe:2.3:a:apple:itunes:9.0.3:::::::*
cpe:2.3:a:apple:itunes:9.2:::::::*
cpe:2.3:a:apple:itunes:9.2.1:::::::*
cpe:2.3:a:apple:itunes:10.0:::::::*
cpe:2.3:a:apple:itunes:10.0.1:::::::*
cpe:2.3:a:apple:itunes:10.1:::::::*
cpe:2.3:a:apple:itunes:10.1.1:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
4	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
5	cpe:2.3:o:microsoft:windows_vista::::::::
6	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
7	cpe:2.3:o:microsoft:windows_xp::sp3::::::*