Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Aug 2013 14:06:04 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Kurt Seifried <kseifried@...hat.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Pedro Ribeiro <pedrib@...il.com>,
        Frank Warmerdam <warmerdam@...ox.com>, oss-security@...ts.openwall.com
Subject: Re: CVE Request -- Four (stack-based) buffer
 overflows and one use-after-free in libtiff v4.0.3 reported by Pedro
 Ribeiro

Hello vendors,

  since Kurt asked for it, below is the summary of the issues.

> 
> Hello Kurt, Steve, vendors,
> 
>   Pedro Ribeiro has recently reported the following five security
> flaws being present in the tools of TIFF library:
>   [1] http://www.asmail.be/msg0055359936.html

* Issue #1 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when reading GIF extension block on crafted GIF image
* Issue #2 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when decoding a GIF raster image
* Issue #3 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when decoding a GIF raster image (same routine like
                               in case #2, just different line code)
* Issue #4 (tools/tiff2pdf.c): Use after free in tiff2pdf tool when reading TIFF file raster image data and writing them to the output PDF XObject's
                               image dictionary stream
* Issue #5 (tools/rgb2ycbcr.c): Stack-based buffer overflow in the rgb2ycbcr tool when performing RGBA to YCbCr conversion (converting
                                non-YCbCr TIFF image to a YCbCr one) when processing crafted rasted date of provided TIFF image file

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> 
> While they are present in the tools (=> not that urgent like they
> would be in the library itself), there's been CVE ids assigned
> in the past for TIFF library tools issues too. To mention some examples:
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4564
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3401
> 
> Since there doesn't seem to be CVE identifiers assigned for these
> [1] issues yet, could you allocate them?
> 
> FWIW regarding the patches and upstream bugs - if my information
> is up2date, there aren't upstream bugs and patches for these issues
> yet.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
> 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.