tiff: CVE-2018-17100: potential int32 overflow in multiply_ms() function

Debian Bug report logs - #909038
tiff: CVE-2018-17100: potential int32 overflow in multiply_ms() function

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tiff: CVE-2018-17100: potential int32 overflow in multiply_ms() function

Date: Mon, 17 Sep 2018 20:53:17 +0200

Source: tiff
Version: 4.0.8-2
Severity: important
Tags: patch security upstream
Forwarded: http://bugzilla.maptools.org/show_bug.cgi?id=2810
Control: found -1 4.0.9-6

Hi,

The following vulnerability was published for tiff.

CVE-2018-17100[0]:
| An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in
| multiply_ms in tools/ppm2tiff.c, which can cause a denial of service
| (crash) or possibly have unspecified other impact via a crafted image
| file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-17100
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17100
[1] http://bugzilla.maptools.org/show_bug.cgi?id=2810

Regards,
Salvatore

Message #12 received at 909038-close@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi (GCS) <gcs@debian.org>

To: 909038-close@bugs.debian.org

Subject: Bug#909038: fixed in tiff 4.0.9+git181026-1

Date: Sun, 28 Oct 2018 15:19:51 +0000

Source: tiff
Source-Version: 4.0.9+git181026-1

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 909038@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 28 Oct 2018 11:04:14 +0000
Source: tiff
Binary: libtiff5 libtiffxx5 libtiff5-dev libtiff-dev libtiff-tools libtiff-opengl libtiff-doc
Architecture: source amd64 all
Version: 4.0.9+git181026-1
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description:
 libtiff-dev - Tag Image File Format library (TIFF), development files, current
 libtiff-doc - TIFF manipulation and conversion documentation
 libtiff-opengl - TIFF manipulation and conversion tools
 libtiff-tools - TIFF manipulation and conversion tools
 libtiff5   - Tag Image File Format (TIFF) library
 libtiff5-dev - Tag Image File Format library (TIFF), development files
 libtiffxx5 - Tag Image File Format (TIFF) library -- C++ interface
Closes: 909037 909038 911635
Changes:
 tiff (4.0.9+git181026-1) unstable; urgency=high
 .
   * Git snapshot, fixing the following security issues:
     - CVE-2018-17100, int32 overflow in multiply_ms() which can cause a DoS
       or possibly have unspecified other impact via a crafted image file
       (closes: #909038),
     - CVE-2018-17101, two out-of-bounds writes in cpTags() which can cause a
       DoS or possibly have unspecified other impact via a crafted image file
       (closes: #909037),
     - CVE-2018-18557, out-of-bounds write in JBIGDecode() (closes: #911635).
   * Remove previously backported security patches.
   * Build with Zstandard, a fast lossless compression algorithm.
   * Build with WebP, the modern VP8 compression format.
   * Update libtiff5 symbols.
Checksums-Sha1:
 380331dc7c95e5f551c0f17eecc72b8f77f38893 2280 tiff_4.0.9+git181026-1.dsc
 67067989a96fc57c54b385ca377913300c5009fc 1520264 tiff_4.0.9+git181026.orig.tar.xz
 adafb1972bd365a209cd23850db7faf67ce856a0 17408 tiff_4.0.9+git181026-1.debian.tar.xz
 6343e5029fe66f38d725b282e071bf9ed87be6ad 96628 libtiff-dev_4.0.9+git181026-1_amd64.deb
 a95fdb60d2ebbb30b23e956d987bcd21475d161a 403488 libtiff-doc_4.0.9+git181026-1_all.deb
 ea3f97fa6434616f40f1ccb7cd4ede2e363525fb 14900 libtiff-opengl-dbgsym_4.0.9+git181026-1_amd64.deb
 cd7cf5ee3894e019294e2fcf79f57ed0e16c62a4 105148 libtiff-opengl_4.0.9+git181026-1_amd64.deb
 9ad2c69f89cf45cb5621e9b39315f6f1b2d6f9d3 421444 libtiff-tools-dbgsym_4.0.9+git181026-1_amd64.deb
 ad3afdd2c760f3ac35ce8b79b3d958413f8345d3 287912 libtiff-tools_4.0.9+git181026-1_amd64.deb
 4a9728366327b24524ebaa79e9878e39be851752 479808 libtiff5-dbgsym_4.0.9+git181026-1_amd64.deb
 65f7f41f1773757ffd06d149e09cbbee444b03e9 371556 libtiff5-dev_4.0.9+git181026-1_amd64.deb
 22f9b362bdf660d464aef06659b603824f79d9d6 249928 libtiff5_4.0.9+git181026-1_amd64.deb
 545435e33051a6f00e3e0b048f8c9ad2de1ecf56 23368 libtiffxx5-dbgsym_4.0.9+git181026-1_amd64.deb
 d5e15ced9dfb90e91688bee65f5dafdb0c72356f 100376 libtiffxx5_4.0.9+git181026-1_amd64.deb
 9b618ef33c7996acc5e5fe2bab6654aa02d65896 12790 tiff_4.0.9+git181026-1_amd64.buildinfo
Checksums-Sha256:
 c62af309cc73df28ace1fcf7d7fa1c4f09f96150d093562347aa711e7d76b08e 2280 tiff_4.0.9+git181026-1.dsc
 a08f8f156d67d0b9504ff01a1456af975a72f51577d52e39b57847201c6bb6ae 1520264 tiff_4.0.9+git181026.orig.tar.xz
 fd02f97164b6768c1e775ce965a69937bd56e4210bdcca8f4d78e4a88d4583cc 17408 tiff_4.0.9+git181026-1.debian.tar.xz
 cd51b100e378cbf40e7c839a1467c87625b21c4c1aae0a7b590ef50f7f46450c 96628 libtiff-dev_4.0.9+git181026-1_amd64.deb
 1b82f2896ec19b855d11f93854adc942cd0b21a8db3c52251578a19b010ca315 403488 libtiff-doc_4.0.9+git181026-1_all.deb
 fa7567f7d73efd38a0bd9692feb857cf399ac2208ac2a9ebb9fcf1f06d386aaf 14900 libtiff-opengl-dbgsym_4.0.9+git181026-1_amd64.deb
 ca01044ea608343370253287d3991b82ce2d55cf4812e3b872d19adf17010d6a 105148 libtiff-opengl_4.0.9+git181026-1_amd64.deb
 eba2054eec6c861b0b5a1135aabe41102ad99e3827ec75bcdbde148e6a04e14a 421444 libtiff-tools-dbgsym_4.0.9+git181026-1_amd64.deb
 463461d86d9f6c4d0fd1e0f412810c3c156dd81162a26f0fdb15677226f7b900 287912 libtiff-tools_4.0.9+git181026-1_amd64.deb
 866cbe2a509d8b794888d227eb2334c787e8ce36a16c5a69382094dd8581d5c1 479808 libtiff5-dbgsym_4.0.9+git181026-1_amd64.deb
 8d6bdc5e138a35200234679e54cdd5d81be0f085aedded90e17b1749971e383c 371556 libtiff5-dev_4.0.9+git181026-1_amd64.deb
 c6dd341b1b157f4aafcec920b69df5e0e4eb269ac5a71f483f0c7843ebf415fb 249928 libtiff5_4.0.9+git181026-1_amd64.deb
 bd048a8742fb8621af94583f20afe7a58aeca16e24fe952ba58a3b0c6b707741 23368 libtiffxx5-dbgsym_4.0.9+git181026-1_amd64.deb
 2f92a6b450f112eca95a8281f7746d8eeda60707f131b37200c023195ade9ae9 100376 libtiffxx5_4.0.9+git181026-1_amd64.deb
 a989ec34304df87e1d0a1f7d2a4becdd107ea368ff9b67ff038238958e333fac 12790 tiff_4.0.9+git181026-1_amd64.buildinfo
Files:
 ab107454751718ff0a1972dbd0e33710 2280 libs optional tiff_4.0.9+git181026-1.dsc
 76cea43835c4e40e3360fb0377277dbc 1520264 libs optional tiff_4.0.9+git181026.orig.tar.xz
 6e092ac0ab0f56caa9711c4c44210ee4 17408 libs optional tiff_4.0.9+git181026-1.debian.tar.xz
 63ad5e1c6f038cb80422a7232e98d00b 96628 oldlibs optional libtiff-dev_4.0.9+git181026-1_amd64.deb
 80ebec254ee919d86316903a926c8531 403488 doc optional libtiff-doc_4.0.9+git181026-1_all.deb
 dab79ea23e848f162f53e65403973210 14900 debug optional libtiff-opengl-dbgsym_4.0.9+git181026-1_amd64.deb
 99f4acc22c951d0f551df966fb2e1eaa 105148 graphics optional libtiff-opengl_4.0.9+git181026-1_amd64.deb
 e34fd464f894d8931c764ebc9bd0d21c 421444 debug optional libtiff-tools-dbgsym_4.0.9+git181026-1_amd64.deb
 554eb78abd2e25497bbc35aa40a9d324 287912 graphics optional libtiff-tools_4.0.9+git181026-1_amd64.deb
 4335c3347cef24963f450be106ab05fc 479808 debug optional libtiff5-dbgsym_4.0.9+git181026-1_amd64.deb
 45c6cd16354e9bbe852d1c70450ca346 371556 libdevel optional libtiff5-dev_4.0.9+git181026-1_amd64.deb
 2a93c016626b8dd9625cc51bacddfc3a 249928 libs optional libtiff5_4.0.9+git181026-1_amd64.deb
 558490734f0e939f9536c684608fea95 23368 debug optional libtiffxx5-dbgsym_4.0.9+git181026-1_amd64.deb
 7d9ad636ce338f856eba15c6e50e72be 100376 libs optional libtiffxx5_4.0.9+git181026-1_amd64.deb
 b8ac4eb53758bbada8a2c1f190b7f9df 12790 libs optional tiff_4.0.9+git181026-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAlvVzksACgkQ3OMQ54ZM
yL9/Xw//XrjN/e1eBuBSbnL3XVvWGIcwH03KtyXIfZ5yg6VZJu48NrUeEjcj1uBp
yQOpJMbTdXDKNsXv0s8wGTSLQAAj4EUYEGGQ1Ln0DymndZUb4VL87vRTEStCBiMS
YxBoqZKN+qMSOY689ckBXnwa2PGp2VQb8TCcCDexGzV+KmJ8J0CiGlfHfGez+Iuf
U0AoZleuwH8QhdmPTfrxiwXVTOA/3+HPcNaqKwNo7fuMzOSnYUKVZHwNuzlSUn7L
2Eyppr6qPy4t9Qhfdu7mKqdrGmWYgI4gj0lAPUDnYAUsk//fY/jZJSNWHtea0dWV
BU433ub1U5eLK5WD4kagjRo0xb6m0F9z58IAhpptzsinXycouZEW1ZB6hfdLwO/Q
DbqIxHRstn0wni2ezKB+K5lAYExoXjnbssXZaXJ5DpKJJOc85ZEsL8RLT+X0qu3X
dvjKvSVct9umrMkZgC2OOGbM9/SjKLU2lg0g/iLdUiQoDmKbR7FXtVJCSWy/SQAt
5UOSq1NAJhST+dORN6AZcYE3+NKbkVPUAb0fXPq24gl8Tgz4PmEB9ZaJm/8vS0pc
ucMVIdYqZN1lfgr4LJuxdNPXL+kdf0JwDO7uCXUoQXglwpRuTivaUXRRwFT61HyW
hLcztccgFr7bNFItpQqvLTuocLFLT6lbg3D9U6PUYRDhgsX4PJw=
=ZObV
-----END PGP SIGNATURE-----

Message #19 received at 909038-close@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@debian.org>

To: 909038-close@bugs.debian.org

Subject: Bug#909038: fixed in tiff 4.0.8-2+deb9u3

Date: Mon, 03 Dec 2018 21:47:28 +0000

Source: tiff
Source-Version: 4.0.8-2+deb9u3

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 909038@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Moritz Mühlenhoff <jmm@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 29 Nov 2018 20:45:11 +0100
Source: tiff
Binary: libtiff5 libtiffxx5 libtiff5-dev libtiff-tools libtiff-opengl libtiff-doc
Architecture: source all amd64
Version: 4.0.8-2+deb9u3
Distribution: stretch-security
Urgency: medium
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Moritz Mühlenhoff <jmm@debian.org>
Description:
 libtiff-doc - TIFF manipulation and conversion documentation
 libtiff-opengl - TIFF manipulation and conversion tools
 libtiff-tools - TIFF manipulation and conversion tools
 libtiff5   - Tag Image File Format (TIFF) library
 libtiff5-dev - Tag Image File Format library (TIFF), development files
 libtiffxx5 - Tag Image File Format (TIFF) library -- C++ interface
Closes: 869823 883320 890441 891288 893806 898348 909037 909038 911635
Changes:
 tiff (4.0.8-2+deb9u3) stretch-security; urgency=medium
 .
   * CVE-2018-5784 (Closes: #890441)
   * CVE-2018-7456 (Closes: #891288)
   * CVE-2018-8905 (Closes: #893806)
   * CVE-2018-10963 (Closes: #898348)
   * CVE-2018-17100 (Closes: #909038)
   * CVE-2018-17101 (Closes: #909037)
   * CVE-2018-18557 (Closes: #911635)
   * CVE-2017-11613 (Closes: #869823)
   * CVE-2017-17095 (Closes: #883320)
Checksums-Sha1:
 2cb52e8c6efcd8c6d38e1c5f6d60192523c51b55 2185 tiff_4.0.8-2+deb9u3.dsc
 898127f7001ec225677d51fe53141007a57bb7b1 32756 tiff_4.0.8-2+deb9u3.debian.tar.xz
 aa38fdf8821543d70952afec491e66b4c4a046d4 395778 libtiff-doc_4.0.8-2+deb9u3_all.deb
 f6b428e72a2c164f83ec0ae30e0d5372cf377890 14186 libtiff-opengl-dbgsym_4.0.8-2+deb9u3_amd64.deb
 81cdae9420ef6e2c5f008361e74ff555d3cf4be8 100438 libtiff-opengl_4.0.8-2+deb9u3_amd64.deb
 d5e9be97e401f76b83118635b35d2af93b3322f8 352006 libtiff-tools-dbgsym_4.0.8-2+deb9u3_amd64.deb
 7e3641266fc2431ca99c8e88edcd1054ee5333ca 281534 libtiff-tools_4.0.8-2+deb9u3_amd64.deb
 139aacc12679be0ff274cf3627af93052346cc4f 372710 libtiff5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 cf5432b5709115c518acf1e694e997af2e9a6497 360908 libtiff5-dev_4.0.8-2+deb9u3_amd64.deb
 a27f420c88c1e321fda42126bdb4d8ac2a3cffbd 238154 libtiff5_4.0.8-2+deb9u3_amd64.deb
 cc6235ba32beafd423cebee85303e4161cd5c2f4 21044 libtiffxx5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 7265689f624cc079517af6462136b4598e768219 95730 libtiffxx5_4.0.8-2+deb9u3_amd64.deb
 388c3bdfe26ad834ac6d37cfca87b7ad5229d9cd 10898 tiff_4.0.8-2+deb9u3_amd64.buildinfo
Checksums-Sha256:
 bd92bfafd8c4918a8a27fd234cf73c35f56e762a4c09d50cc46cf31563f32c3d 2185 tiff_4.0.8-2+deb9u3.dsc
 3fa255bdca1852653425fabc2f12884116fd688ccd1a018feb14877fb3a02f99 32756 tiff_4.0.8-2+deb9u3.debian.tar.xz
 12fd55720c500960495a659508618eb1ca4ac68531ad4dc4d3b74ca5c70e1b2f 395778 libtiff-doc_4.0.8-2+deb9u3_all.deb
 e92e0b6c9f8a47378902448a6376ff3a96b7d6da2ff37b71ba9c41ba9d6dbbe6 14186 libtiff-opengl-dbgsym_4.0.8-2+deb9u3_amd64.deb
 d97170b0a42d1973ee9baafbc4bc331479b43df281f702ce23c229c09de8ec53 100438 libtiff-opengl_4.0.8-2+deb9u3_amd64.deb
 2be1adb5db654f6904a0e67c845a12566266b5a6e2f8173e054b45745af0945b 352006 libtiff-tools-dbgsym_4.0.8-2+deb9u3_amd64.deb
 b4827f18e5ec1763a8477bfae813fa413018ba9243830ce113238fd0f376523c 281534 libtiff-tools_4.0.8-2+deb9u3_amd64.deb
 f28cfd4099254030cb7f630cad492fc9dd0cf6341e4c85c917a4e7faca3e3b56 372710 libtiff5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 519e1ade7358499043f0450f9770e3e5060c3165bc03062296f1ea1da2586158 360908 libtiff5-dev_4.0.8-2+deb9u3_amd64.deb
 de919fe3b2052e462c7b18a836a913b3ae6fe89a7f77835134991d78404192b9 238154 libtiff5_4.0.8-2+deb9u3_amd64.deb
 d5684408b5921c7ca5e3ab5be65cefd19be48ecc3887e23d2b0addfaec04d9b3 21044 libtiffxx5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 bdbcd72872fd58be5ca862915d4c5964d9852705fbd18f6182a0be1271b3e8bb 95730 libtiffxx5_4.0.8-2+deb9u3_amd64.deb
 d2d1b6401fc4b23d9a6c3b4b28f6270b43096adb4e9c7872cce61f6981a4c839 10898 tiff_4.0.8-2+deb9u3_amd64.buildinfo
Files:
 f59f746c3bbae9f17676b83420780cd9 2185 libs optional tiff_4.0.8-2+deb9u3.dsc
 e814b54f2477641278eca5bcaa4f4acb 32756 libs optional tiff_4.0.8-2+deb9u3.debian.tar.xz
 0f5d404a3438be6597839159ee403c35 395778 doc optional libtiff-doc_4.0.8-2+deb9u3_all.deb
 b3fb9038740b02be609a929cc967624a 14186 debug extra libtiff-opengl-dbgsym_4.0.8-2+deb9u3_amd64.deb
 482c3d39785f462979b61aaf5bcde335 100438 graphics optional libtiff-opengl_4.0.8-2+deb9u3_amd64.deb
 b4fbac27d7c43a342290e5992fa4a2ba 352006 debug extra libtiff-tools-dbgsym_4.0.8-2+deb9u3_amd64.deb
 3ca8e1538fe57a4948871865021d98d4 281534 graphics optional libtiff-tools_4.0.8-2+deb9u3_amd64.deb
 25390f391ab809ef4468a5487e3cf2e9 372710 debug extra libtiff5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 4c03c052cb53ff2e74c880ed4f82d8a4 360908 libdevel optional libtiff5-dev_4.0.8-2+deb9u3_amd64.deb
 d02d89c48b9ac263fecbdb75bb1a7c87 238154 libs optional libtiff5_4.0.8-2+deb9u3_amd64.deb
 e5b4f0cca3c89bdd05d72a23e9228a1b 21044 debug extra libtiffxx5-dbgsym_4.0.8-2+deb9u3_amd64.deb
 2ad358b2204823906149a95a580b88c0 95730 libs optional libtiffxx5_4.0.8-2+deb9u3_amd64.deb
 e9c5631ac7e31b180499a33dca1f6438 10898 libs optional tiff_4.0.8-2+deb9u3_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlwASXoACgkQEMKTtsN8
TjayFw//de7iqw1Mt0cbYvmaTUgelfC/m8lZXLfjNfL0mOmiiVJpHaQwI2ti5eJm
Jct+OtQCpmwQr1sJg7QC/i++KmIYPbmERFdQjZGI/Zsq+1nhEU7DcOXkLRRrZySt
ftACsBm1AoakUwmixcrSUFvYbJ05LQP5mfmDa+mKjQ75OlV1FxKgAfRyMIW8QVQU
u9r95xOXswVw0JNtqX5ziYJd8FUGDwUHdzXgZG1CUDQF4hsQJ8QVSR5Wsfk2y4f6
xmqPw0/uw1xNNx01mGXUUSskxqKBjXBw+7lU0D0rPATuR1Sh4v+pL3aBHBYDERX2
5CYYAsH5xdxyuE7qRfhYwAqvoH4rFiXWrxlIY7ihbhKSM3Jz4ZxWE69SChf7q+dp
9/6BXmaGmrSAXELiJ2H/ryD5MQzfpCVY0PAmGo6WgGR4joobFblTQO3aVdQGr/Oy
0M2KU/HuuVkd24deIJsVFUFYhty2ezWfTkRTgaFngpOm0rGTbUMTmCAoPF6mgtdk
QBmXgkoDaCGta4XtxVXLdiEpANP1xhYIkj1dlGPl1b6qJiBhV/wSu3gnxdnnQUEB
EcvAnROUu71i6Y8NVOkNo5xSmcWWEKZmTxLbaZTy8BGspntKZCEt8NU+NekJmmEa
LmVftfLrUmzKLlqMUW0Qt9jKv1kah6yagy7hYOn09jIefVqfsXU=
=fAGn
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.