oss-security - Re: Multiple vulnerabilities in LibTIFF and associated tools

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALx_OUDtr80X9k=xZcJZkCLuBoCdOmwh46Pn2HwJpAepa-uP6A@mail.gmail.com>
Date: Sat, 24 Jan 2015 14:55:32 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Multiple vulnerabilities in LibTIFF and associated tools

Oh well... if the cat is out the bag anyway, here's what I reported to
them. These affect the library itself and would also impact uses
within ImageMagick, etc.

http://lcamtuf.coredump.cx/afl/vulns/libtiff-mem2.tif

  - uninitialized memory in putcontig8bitCIELab / TIFFCIELabToXYZ
    I'm guesisng this is a dupe of CVE-2014-8127

http://lcamtuf.coredump.cx/afl/vulns/libtiff-cvs-1.tif

  - uninitialized memory in putcontig8bitYCbCr21tile
    Fixed in:

      2014-12-29  Even Rouault  <even.rouault@...tialys.com>

      * libtiff/tif_getimage.c: in OJPEG case, fix checks on strile width/height
        in the putcontig8bitYCbCr42tile, putcontig8bitYCbCr41tile and
        putcontig8bitYCbCr21tile cases.

    I don't think this had a CVE number assigned yet.

http://lcamtuf.coredump.cx/afl/vulns/libtiff-cvs-2.tif

  - uninitialized memory in NeXTDecode
    Fixed in:

      2014-12-29  Even Rouault  <even.rouault@...tialys.com>

      * libtiff/tif_next.c: add new tests to check that we don't read outside of
      the compressed input stream buffer.

    I don't think this had a CVE number assigned yet.

http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif

  - another use of uninitialized memory in NeXTDecode after fixing the
previous case.
    I don't think this had a CVE number assigned yet.

The communications with upstream have been spotty, which is probably
in part because many people are submitting crash reports at once. I
don't know when they plan the next release, and the commits often
aren't flagged as security-relevant or credited to any particular
report or reporter.

Anyway, the bottom line is that for now, using the last stable version
of libtiff on anything attacker-controlled is probably a bad idea.

/mz

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.