Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100624153827.31d04d0e@redhat.com>
Date: Thu, 24 Jun 2010 15:38:27 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: dan.j.rosenberg@...il.com
Subject: Re: CVE requests: LibTIFF

On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote:

> >> 1.  Out-of-bounds read in TIFFExtractData() may result in
> >> application crash (no reference, fixed upstream).  Reported by Dan
> >> Rosenberg.
> >
> > Do you have any info on this?  I don't see anything obviously
> > related in changelog.  TIFFExtractData itself and all its uses seem
> > unchanged for years.
> 
> Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring
> valid tag type information for each TIFF directory entry.  Prior to
> this fix, unknown tag types would result in an out-of-bounds array
> index in TIFFExtractData() on any code path using this macro.  Ubuntu
> security backported this fix as debian/patches/fix-unknown-tags.patch
> in their libtiff4 package.

So the reference is:
  http://bugzilla.maptools.org/show_bug.cgi?id=2210

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.