Re: CVE requests: LibTIFF

[Tomas Hoger <thoger () redhat com>]

On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote:

> > > 1.  Out-of-bounds read in TIFFExtractData() may result in
> > > application crash (no reference, fixed upstream).  Reported by Dan
> > > Rosenberg.
> >
> > Do you have any info on this?  I don't see anything obviously
> > related in changelog.  TIFFExtractData itself and all its uses seem
> > unchanged for years.
>
> Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring
> valid tag type information for each TIFF directory entry.  Prior to
> this fix, unknown tag types would result in an out-of-bounds array
> index in TIFFExtractData() on any code path using this macro.  Ubuntu
> security backported this fix as debian/patches/fix-unknown-tags.patch
> in their libtiff4 package.

So the reference is:
  http://bugzilla.maptools.org/show_bug.cgi?id=2210

-- 
Tomas Hoger / Red Hat Security Response Team