Date: Tue, 29 Aug 2017 15:49:46 +0200 From: Agostino Sarubbo <ago@...too.org> To: oss-security@...ts.openwall.com Subject: Re: A bunch of duplicate CVEs requested for?? bho.. Another recent example by owl337: https://nvd.nist.gov/vuln/detail/CVE-2017-13737 which points to: https://bugzilla.redhat.com/show_bug.cgi?id=1484196 There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. The maintainer of Graphicsmagick, Mr Bob Friesenhahn said to me: "It looks like this problem is not a GM bug but it is already fixed in libtiff. Using latest libtiff CVS sources I see this in the GM traces which are produced by libtiff: 08:41:48 0:01 0.000u 25164 tiff.c/unknown/2268/Coder: Allocating scanline buffer of 104 bytes 08:41:48 0:01 0.000u 25164 tiff.c/unknown/932/Coder: TIFF Warning: Discarding 89 bytes to avoid buffer overrun. 08:41:48 0:01 0.000u 25164 tiff.c/unknown/932/Coder: TIFF Warning: Discarding 16 bytes to avoid buffer overrun. 08:41:48 0:01 0.000u 25164 tiff.c/unknown/932/Coder: TIFF Warning: Discarding 1 bytes to avoid buffer overrun. 08:41:48 0:01 0.000u 25164 tiff.c/unknown/932/Coder: TIFF Warning: Terminating PackBitsDecode due to lack of data.. 08:41:48 0:01 0.000u 25164 tiff.c/unknown/793/Coder: Not enough data for scanline 3. (PackBitsDecode) I am not sure what libtiff Red Hat is using. It may be that the changes are since the latest libtiff release. I could help with that by making another libtiff release." -- Agostino Sarubbo Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ