CVE-2011-0191

Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.

• CWE-119

• http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
• http://secunia.com/advisories/43934
• http://support.apple.com/kb/HT4554Vendor Advisory
• http://support.apple.com/kb/HT4564
• http://support.apple.com/kb/HT4565
• http://support.apple.com/kb/HT4566
• http://support.apple.com/kb/HT4581
• http://www.debian.org/security/2011/dsa-2210
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
• http://www.securityfocus.com/bid/46657
• http://www.vupen.com/english/advisories/2011/0845
• http://www.vupen.com/english/advisories/2011/0859
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
• http://secunia.com/advisories/43934
• http://support.apple.com/kb/HT4554Vendor Advisory
• http://support.apple.com/kb/HT4564
• http://support.apple.com/kb/HT4565
• http://support.apple.com/kb/HT4566
• http://support.apple.com/kb/HT4581
• http://www.debian.org/security/2011/dsa-2210
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
• http://www.securityfocus.com/bid/46657
• http://www.vupen.com/english/advisories/2011/0845
• http://www.vupen.com/english/advisories/2011/0859

Published

Mar 3, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-0185Format string vulnerability in the debug-logging feature in …
• CVE-2011-0186QuickTime in Apple Mac OS X before 10.6.7 allows remote atta…
• CVE-2011-0187The plug-in in QuickTime in Apple Mac OS X before 10.6.7 all…
• CVE-2011-0188The VpMemAlloc function in bigdecimal.c in the BigDecimal cl…
• CVE-2011-0189The default configuration of Terminal in Apple Mac OS X 10.6…
• CVE-2011-0190Install Helper in Installer in Apple Mac OS X before 10.6.7 …
• CVE-2011-0192Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly …
• CVE-2011-0193Multiple buffer overflows in Image RAW in Apple Mac OS X bef…
• CVE-2011-0194Integer overflow in ImageIO in Apple Mac OS X 10.6 before 10…
• CVE-2011-0195The generate-id XPath function in libxslt in Apple iOS 4.3.x…
• CVE-2011-0196AirPort in Apple Mac OS X 10.5.8 allows remote attackers to …
• CVE-2011-0197App Store in Apple Mac OS X before 10.6.8 creates a log entr…