CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Kurt, Steve, vendors,

  Pedro Ribeiro has recently reported the following five security
flaws being present in the tools of TIFF library:
  [1] http://www.asmail.be/msg0055359936.html

While they are present in the tools (=> not that urgent like they
would be in the library itself), there's been CVE ids assigned
in the past for TIFF library tools issues too. To mention some examples:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4564
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3401

Since there doesn't seem to be CVE identifiers assigned for these
[1] issues yet, could you allocate them?

FWIW regarding the patches and upstream bugs - if my information
is up2date, there aren't upstream bugs and patches for these issues
yet.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team