tiff: CVE-2017-17095: heap-based buffer overflow in pal2rgb tool

Debian Bug report logs - #883320
tiff: CVE-2017-17095: heap-based buffer overflow in pal2rgb tool

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: submit@bugs.debian.org

Subject: tiff: CVE-2017-17095: heap-based buffer overflow in pal2rgb tool

Date: Sat, 2 Dec 2017 11:58:05 +0100

Source: tiff
Version: 4.0.8-6
X-Debbugs-CC: team@security.debian.org secure-testing-team@lists.alioth.debian.org
Severity: normal
Tags: security upstream
Forwarded: http://bugzilla.maptools.org/show_bug.cgi?id=2750

Hi,

the following vulnerability was published for tiff. Since it only
leads to a crash in cli tool we marked it as unimportant in the
security-tracker, still filling a bug to keep track of a fix if it
lands upstream.

CVE-2017-17095[0]:
| tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to
| cause a denial of service (TIFFSetupStrips heap-based buffer overflow
| and application crash) or possibly have unspecified other impact via a
| crafted TIFF file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17095
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17095
[1] http://bugzilla.maptools.org/show_bug.cgi?id=2750


Please adjust the affected versions in the BTS as needed, only
unstable has been checked.

Regards,
Salvatore

Message #10 received at 883320-close@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi (GCS) <gcs@debian.org>

To: 883320-close@bugs.debian.org

Subject: Bug#883320: fixed in tiff 4.0.9-5

Date: Sun, 15 Apr 2018 19:21:51 +0000

Source: tiff
Source-Version: 4.0.9-5

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 883320@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 15 Apr 2018 18:13:42 +0000
Source: tiff
Binary: libtiff5 libtiffxx5 libtiff5-dev libtiff-dev libtiff-tools libtiff-opengl libtiff-doc
Architecture: source amd64 all
Version: 4.0.9-5
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description:
 libtiff-dev - Tag Image File Format library (TIFF), development files, current
 libtiff-doc - TIFF manipulation and conversion documentation
 libtiff-opengl - TIFF manipulation and conversion tools
 libtiff-tools - TIFF manipulation and conversion tools
 libtiff5   - Tag Image File Format (TIFF) library
 libtiff5-dev - Tag Image File Format library (TIFF), development files
 libtiffxx5 - Tag Image File Format (TIFF) library -- C++ interface
Closes: 869823 883320 891288
Changes:
 tiff (4.0.9-5) unstable; urgency=high
 .
   * Fix CVE-2017-11613: avoid memory exhaustion in
     ChopUpSingleUncompressedStrip() (closes: #869823).
   * Fix CVE-2018-7456: NULL pointer dereference in TIFFPrintDirectory()
     (closes: #891288).
   * Fix CVE-2017-17095: heap-based buffer overflow in pal2rgb tool
     (closes: #883320).
   * Don't specify parallel to debhelper.
   * Update Standards-Version to 4.1.4 .
Checksums-Sha1:
 89b5b03490d29c89bdc8d29e5adbca11cfddc0ac 2184 tiff_4.0.9-5.dsc
 c7b31db61dd17d89ee488790e1c906bf8f3abce6 22864 tiff_4.0.9-5.debian.tar.xz
 bf21c77518a73eda63408a7e1a16fa4c9162d9ed 96320 libtiff-dev_4.0.9-5_amd64.deb
 0e3fa54f22ab387932fd212d1f6096d3b1697705 403280 libtiff-doc_4.0.9-5_all.deb
 c302361f0ba12dde13e789583909869425d6ed45 13752 libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 be246ae589c9d27b5230fd3fa6704e5423937513 104848 libtiff-opengl_4.0.9-5_amd64.deb
 e4a34497cb9bb20e7de6310b26af0ef6f635227e 348292 libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 28b6d4ea00c51df2958a0c7657c9495b7d0aa91f 286980 libtiff-tools_4.0.9-5_amd64.deb
 f1ae499bf30e7790f59876430f7c3c5b3f2aad1f 376692 libtiff5-dbgsym_4.0.9-5_amd64.deb
 1cb41b832591670bda407f6c3492af6f216c5472 367464 libtiff5-dev_4.0.9-5_amd64.deb
 8ccdd356549d6dd52ddf3b1d7f5e4ec3b8ded1cb 245632 libtiff5_4.0.9-5_amd64.deb
 cfb90d9bd23407bfbfb92027820c81ba880ff0e1 21268 libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 8900e34afc3d7353bbf314a6fd93f11c412e1bf3 100044 libtiffxx5_4.0.9-5_amd64.deb
 7168331074f126952da9ea23e8efd899a3cc4dbf 12131 tiff_4.0.9-5_amd64.buildinfo
Checksums-Sha256:
 f708f46910204e0a009edd7ae709fd7c9a4b467775d36ca4160aab290c195bd6 2184 tiff_4.0.9-5.dsc
 5c98180b77457fc5452f3b4fed85862172dbfdb342d7a98e88363e439a669c96 22864 tiff_4.0.9-5.debian.tar.xz
 7667bb7574545c2131b7bf9c2dccd072364edd5be94d25255d6558dc64d9ef72 96320 libtiff-dev_4.0.9-5_amd64.deb
 776955232fb4606537a2282ebbc6c307587201823cede71328e0cc5e43de987c 403280 libtiff-doc_4.0.9-5_all.deb
 615e9c1ed3f6c89dfd43671c208a621dd1e5129ce0a97cd897255d5fbd2ba621 13752 libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 9d95a4784b10001b736dabedfb5a5a8fd1623769bb9ae527a7e27f8ab0f1e4a0 104848 libtiff-opengl_4.0.9-5_amd64.deb
 5022d7ae68a550a079c6ba2b8c8d632e84f828fd1006e992c1e8ce0be719ebdf 348292 libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 1a8d88b79e690e9f504e293f8bdb224f05f2587c2ac4ee104975042ae4708430 286980 libtiff-tools_4.0.9-5_amd64.deb
 95a97d09eb954bb0c228c9aad4f6a4f596231fa13675a444fad5a65f0e3c449e 376692 libtiff5-dbgsym_4.0.9-5_amd64.deb
 f8585c5ffc1f8ca593ea045f760c91e5c1b2ecaffe33fd2ff35d59e29a962a54 367464 libtiff5-dev_4.0.9-5_amd64.deb
 18778122ad6201d8edb41d1bc79fb14415ce51ee83e24d3d0b6a3230fcfbcd9d 245632 libtiff5_4.0.9-5_amd64.deb
 8810671bfe2bd766877b4c50ef444937efaf1a2ba654acaa90b2b59270c97aa8 21268 libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 64e79614a1a71c2f142ffb7c86a7e41a959c2d18e5bcf8ea9010c102c05d3f1b 100044 libtiffxx5_4.0.9-5_amd64.deb
 ac2de2cc65b42ce63c39ddb3fcd06280bb801814a7264f1e9b6a284df0b6b814 12131 tiff_4.0.9-5_amd64.buildinfo
Files:
 7c4518cdeb95460173802a748ce76c6e 2184 libs optional tiff_4.0.9-5.dsc
 22d7c422438c6270fe7ac79913f86d0d 22864 libs optional tiff_4.0.9-5.debian.tar.xz
 225464e88da83a85836b867c5d8f2ddc 96320 oldlibs optional libtiff-dev_4.0.9-5_amd64.deb
 99f1c8d8e02fffe5ba05493b640338cf 403280 doc optional libtiff-doc_4.0.9-5_all.deb
 18cedeff0aecb5e0dc19e2115c4b2b19 13752 debug optional libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 3c3656858197d4d71da034521c27ef8d 104848 graphics optional libtiff-opengl_4.0.9-5_amd64.deb
 7ef79531d8b9d189f1b1cb64ebcd21ff 348292 debug optional libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 b413e56e2a5dcb3054fed7f30f745c67 286980 graphics optional libtiff-tools_4.0.9-5_amd64.deb
 4be386931aa02908e4d711ce0c09a5e0 376692 debug optional libtiff5-dbgsym_4.0.9-5_amd64.deb
 a0fef22485949f76a4ee3c18962d6687 367464 libdevel optional libtiff5-dev_4.0.9-5_amd64.deb
 b8f62d32fbfc65dafeb4c163bcefc5c7 245632 libs optional libtiff5_4.0.9-5_amd64.deb
 ab2901df81dc64a57bf4d653cae37cb3 21268 debug optional libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 ccfc7dc5cea835633b9a292a621b5e48 100044 libs optional libtiffxx5_4.0.9-5_amd64.deb
 b932630b31e4e31e6506f79174d0c2c7 12131 libs optional tiff_4.0.9-5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAlrToMYACgkQ3OMQ54ZM
yL+MFxAAojHYv2PylcGrTFNGDBwDLDHjka/8aH33JCoG641qPtlZDLrtw84bPOOW
Y9I0gIA6rJzxH0ajbx6ifTlDzrO5Gon9E6R+DZqTesayjB7iw5X60vIFIqfADolt
USGOAGeU9y2oZTvNKuWXucfszJ0dRJwm7Uz2WZEkRlSQVUv8CMsa8XTk7BoTEo/2
TzDnS5OsX5jXKYZnbbakbpJNfTW+4mFdeVWBIQwhDEDD0yZ4rHr8j50F8vkASbVq
H7IwDerapBgYba7a27wOFmteDw4meeKofokJAM5b4juwlrYzLP1KKEESztLSh4K9
2cHf+vBRSPBsTasuINkW0PhLfAovsf6vkonWrkXqcOzBk8NNwOb1HXO4CO3JmADD
S2TlyXZf6kJLRzLUwZoZZXc6YgVlggDDXt0Tp88C+T5aHafqpsuC0C0bIU+0sueo
cs4QxFK6ptyEz7MQe8nW3Co27flO7CI9uXhWf85VNc1u/0cLxUXchuO1NInPgvhu
qY5pY8BzRciaz4sD1Ctx8j32LxVQjz+lPrVnUgJ6/PgxLUi+jDt1JxrfgKXLwYUz
QiBbN8WeZa1v5vehwHLkZD+bkpRAbwO4d4ojy0L3AhEDV9UwAy/06IR7FjZWuHPS
++tqaIpkbFg+9uVwJ/tm/uXdEZVlrtK6rLpgDzkFJTtovHR8DW4=
=gKts
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.