[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100624090359.362d34ea@redhat.com>
Date: Thu, 24 Jun 2010 09:03:59 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: dan.j.rosenberg@...il.com
Subject: Re: CVE requests: LibTIFF
On Wed, 23 Jun 2010 14:01:14 -0400 Dan Rosenberg wrote:
> 1. Out-of-bounds read in TIFFExtractData() may result in application
> crash (no reference, fixed upstream). Reported by Dan Rosenberg.
Do you have any info on this? I don't see anything obviously related
in changelog. TIFFExtractData itself and all its uses seem unchanged
for years.
> 2. Out-of-bounds read in TIFFVGetField() may result in application
> crash
> (https://bugs.launchpad.net/ubuntu/lucid/+source/tiff/+bug/589145).
This is NULL deref. Another Sauli's test case shows that similar
problem can occur with NULL td_stripbytecount few lines below
td_stripoffset case addressed in upstream patch.
> The fix for this issue was combined with the fix for CVE-2010-2065,
> but it appears to be a separate issue. Reported by Sauli Pahlman.
Right, not related to what CVE-2010-2065 was assigned to.
> 3. Memory corruption in TIFFRGBAImageGet() due to buffer overflow
> (https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/591605).
> Reported by Sauli Pahlman.
IIRC, Sauli's file only demonstrates OOB read. Upstream bug:
http://bugzilla.maptools.org/show_bug.cgi?id=2216
> 4. http://bugzilla.maptools.org/show_bug.cgi?id=2207 ("tif_getimage
> fails when flipping vertically on 64-bit platforms")
CVE-2010-2233 was assigned to this issue.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
