oss-sec mailing list archives
Re: CVE requests: LibTIFF
From: Dan Rosenberg <dan.j.rosenberg () gmail com>
Date: Tue, 29 Jun 2010 08:05:25 -0400
On request, I'm re-posting the issues which I think actually deserve CVE ids. The following three issues reliably crash libtiff in the general case of doing initial parsing to view an image: 1. Out-of-bounds read in TIFFExtractData() may result in application crash. Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring valid type information for each TIFF directory entry. Prior to this fix, unknown tag types would result in an out-of-bounds array index in TIFFExtractData() on any code path using this macro. Ubuntu security backported this fix as debian/patches/fix-unknown-tags.patch because in discussion with them, I identified the patch as a fix for this issue. I discovered this issue and disclosed it to iDefense Labs along with the SubjectDistance overflow, but they did not share details of this with downstream vendors (which was the source of my confusion surrounding knowledge of the issue). It seems that it was actually fixed in 3.9.4 inadvertently as a result of fixing another unrelated problem, and my description of it here can be considered the first disclosure of the issue, which affects all versions 3.x <= 3.9.2. 2. A NULL pointer derefrence in TIFFVGetField() may result in application crash (https://bugs.launchpad.net/ubuntu/lucid/+source/tiff/+bug/589145). The fix for this issue was combined with the fix for CVE-2010-2065, but it has been confirmed to be a separate issue. Reported by Sauli Pahlman. 3. Out-of-bounds read in TIFFRGBAImageGet() due to reading past the bounds of a buffer (https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/591605) may lead to application crash. Reported by Sauli Pahlman. The remainder of the issues have already been assigned CVEs or require additional user assistance to trigger, as as such can be considered stability issues rather than security. Thanks, Dan On Thu, Jun 24, 2010 at 9:38 AM, Tomas Hoger <thoger () redhat com> wrote:
On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote:1. Out-of-bounds read in TIFFExtractData() may result in application crash (no reference, fixed upstream). Reported by Dan Rosenberg.Do you have any info on this? I don't see anything obviously related in changelog. TIFFExtractData itself and all its uses seem unchanged for years.Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring valid tag type information for each TIFF directory entry. Prior to this fix, unknown tag types would result in an out-of-bounds array index in TIFFExtractData() on any code path using this macro. Ubuntu security backported this fix as debian/patches/fix-unknown-tags.patch in their libtiff4 package.So the reference is: http://bugzilla.maptools.org/show_bug.cgi?id=2210 -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- CVE requests: LibTIFF Dan Rosenberg (Jun 23)
- Re: CVE requests: LibTIFF Tomas Hoger (Jun 24)
- Re: CVE requests: LibTIFF Dan Rosenberg (Jun 24)
- Re: CVE requests: LibTIFF Tomas Hoger (Jun 24)
- Re: CVE requests: LibTIFF Dan Rosenberg (Jun 29)
- Re: CVE requests: LibTIFF Tomas Hoger (Jun 29)
- Re: CVE requests: LibTIFF Dan Rosenberg (Jun 29)
- Re: CVE requests: LibTIFF Josh Bressers (Jun 30)
- Re: CVE requests: LibTIFF Dan Rosenberg (Jun 30)
- Re: CVE requests: LibTIFF Dan Rosenberg (Jun 24)
- Re: CVE requests: LibTIFF Tomas Hoger (Jun 24)
- <Possible follow-ups>
- Re: CVE requests: LibTIFF Josh Bressers (Jun 30)