[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 Jun 2010 15:38:27 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: dan.j.rosenberg@...il.com
Subject: Re: CVE requests: LibTIFF
On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote:
> >> 1. Out-of-bounds read in TIFFExtractData() may result in
> >> application crash (no reference, fixed upstream). Reported by Dan
> >> Rosenberg.
> >
> > Do you have any info on this? I don't see anything obviously
> > related in changelog. TIFFExtractData itself and all its uses seem
> > unchanged for years.
>
> Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring
> valid tag type information for each TIFF directory entry. Prior to
> this fix, unknown tag types would result in an out-of-bounds array
> index in TIFFExtractData() on any code path using this macro. Ubuntu
> security backported this fix as debian/patches/fix-unknown-tags.patch
> in their libtiff4 package.
So the reference is:
http://bugzilla.maptools.org/show_bug.cgi?id=2210
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
