tiff: CVE-2012-3401 heap overflow in tiff2pdf

Debian Bug report logs - #682115
tiff: CVE-2012-3401 heap overflow in tiff2pdf

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Marc Deslauriers <marc.deslauriers@ubuntu.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tiff: CVE-2012-3401 heap overflow in tiff2pdf

Date: Thu, 19 Jul 2012 10:38:35 -0400

[Message part 1 (text/plain, inline)]

Package: tiff
Version: 4.0.2-1
Severity: normal
Tags: patch
User: ubuntu-devel@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch



*** /tmp/tmpgGHwFf/bug_body
In Ubuntu, the attached patch was applied to achieve the following:

  * SECURITY UPDATE: possible arbitrary code execution via heap overflow
    in tiff2pdf.
    - debian/patches/CVE-2012-3401.patch: properly set t2p->t2p_error in
      tools/tiff2pdf.c.
    - CVE-2012-3401


Thanks for considering the patch.


-- System Information:
Debian Release: wheezy/sid
  APT prefers precise-updates
  APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500, 'precise-proposed'), (500, 'precise')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-27-generic (SMP w/4 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

[tiff_4.0.2-1ubuntu2.debdiff (text/x-diff, attachment)]

Message #16 received at 682115@bugs.debian.org (full text, mbox, reply):

From: Jay Berkenbilt <qjb@debian.org>

To: Marc Deslauriers <marc.deslauriers@ubuntu.com>

Cc: 682115@bugs.debian.org

Subject: Re: Bug#682115: tiff: CVE-2012-3401 heap overflow in tiff2pdf

Date: Sat, 21 Jul 2012 20:57:57 -0400

Marc Deslauriers <marc.deslauriers@ubuntu.com> wrote:

> *** /tmp/tmpgGHwFf/bug_body
> In Ubuntu, the attached patch was applied to achieve the following:
>
>   * SECURITY UPDATE: possible arbitrary code execution via heap overflow
>     in tiff2pdf.
>     - debian/patches/CVE-2012-3401.patch: properly set t2p->t2p_error in
>       tools/tiff2pdf.c.
>     - CVE-2012-3401
>
>
> Thanks for considering the patch.

I will try to get this patch in this weekend.  Thanks.  Note that
tiff2pdf from the tiff3 package is not actually installed (it comes from
the tiff package, which is 4.x), but I'll still apply the patch to avoid
confusion.  I'll certainly apply the patch to the tiff package.

-- 
Jay Berkenbilt <qjb@debian.org>

Message #21 received at 682115@bugs.debian.org (full text, mbox, reply):

From: Marc Deslauriers <marc.deslauriers@ubuntu.com>

To: Jay Berkenbilt <qjb@debian.org>

Cc: 682115@bugs.debian.org

Subject: Re: Bug#682115: tiff: CVE-2012-3401 heap overflow in tiff2pdf

Date: Sat, 21 Jul 2012 21:19:30 -0400

On Sat, 2012-07-21 at 20:57 -0400, Jay Berkenbilt wrote:
> Marc Deslauriers <marc.deslauriers@ubuntu.com> wrote:
> 
> > *** /tmp/tmpgGHwFf/bug_body
> > In Ubuntu, the attached patch was applied to achieve the following:
> >
> >   * SECURITY UPDATE: possible arbitrary code execution via heap overflow
> >     in tiff2pdf.
> >     - debian/patches/CVE-2012-3401.patch: properly set t2p->t2p_error in
> >       tools/tiff2pdf.c.
> >     - CVE-2012-3401
> >
> >
> > Thanks for considering the patch.
> 
> I will try to get this patch in this weekend.  Thanks.  Note that
> tiff2pdf from the tiff3 package is not actually installed (it comes from
> the tiff package, which is 4.x), but I'll still apply the patch to avoid
> confusion.  I'll certainly apply the patch to the tiff package.
> 

Yeah, I skipped the tiff3 package in Quantal too for the same reason.

Marc.

Message #26 received at 682115-close@bugs.debian.org (full text, mbox, reply):

From: Jay Berkenbilt <qjb@debian.org>

To: 682115-close@bugs.debian.org

Subject: Bug#682115: fixed in tiff 4.0.2-2

Date: Sun, 22 Jul 2012 01:47:12 +0000

Source: tiff
Source-Version: 4.0.2-2

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 682115@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jay Berkenbilt <qjb@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 21 Jul 2012 21:27:34 -0400
Source: tiff
Binary: libtiff5 libtiffxx5 libtiff5-dev libtiff5-alt-dev libtiff-tools libtiff-opengl libtiff-doc
Architecture: source all amd64
Version: 4.0.2-2
Distribution: unstable
Urgency: high
Maintainer: Jay Berkenbilt <qjb@debian.org>
Changed-By: Jay Berkenbilt <qjb@debian.org>
Description: 
 libtiff-doc - TIFF manipulation and conversion documentation
 libtiff-opengl - TIFF manipulation and conversion tools
 libtiff-tools - TIFF manipulation and conversion tools
 libtiff5   - Tag Image File Format (TIFF) library
 libtiff5-alt-dev - Tag Image File Format library (TIFF), alternative development fil
 libtiff5-dev - Tag Image File Format library (TIFF), development files
 libtiffxx5 - Tag Image File Format (TIFF) library -- C++ interface
Closes: 682115
Changes: 
 tiff (4.0.2-2) unstable; urgency=high
 .
   * SECURITY UPDATE: possible arbitrary code execution via heap overflow
     in tiff2pdf.  (Closes: #682115)
     - debian/patches/CVE-2012-3401.patch: properly set t2p->t2p_error in
       tools/tiff2pdf.c.
     - CVE-2012-3401
     Changes prepared by Marc Deslauriers for Ubuntu.  Thanks!
Checksums-Sha1: 
 24f30ac5d418431dd81ed7429be98acdbbe00673 2124 tiff_4.0.2-2.dsc
 a5ea44ac0a886feb76b985597e07b41640555d60 14937 tiff_4.0.2-2.debian.tar.gz
 b423b2a1a1999d972fbef4e2ab52e7cda978927f 395214 libtiff-doc_4.0.2-2_all.deb
 e25d413b0fc65f708c7ae7a7eb51a9962fb78597 233744 libtiff5_4.0.2-2_amd64.deb
 106aef81c7bbf26037b1c90d81c363257453cbd6 72918 libtiffxx5_4.0.2-2_amd64.deb
 40017b89ea467a07d207bd35209ba333de20ca6e 375596 libtiff5-dev_4.0.2-2_amd64.deb
 4ed8ab27a858162e210276af485a2433e2a6d0b1 295564 libtiff5-alt-dev_4.0.2-2_amd64.deb
 1a7aeb1568d1c4dd43d42a442c0e21fa6b19affa 336560 libtiff-tools_4.0.2-2_amd64.deb
 5fa6c7f5a1d69a70f7b956275ebfd078237e9458 78588 libtiff-opengl_4.0.2-2_amd64.deb
Checksums-Sha256: 
 50cc77d9617011449e2a02b7d2e89361a0b8984f231a23a09f140fab82c7eee4 2124 tiff_4.0.2-2.dsc
 c026f6c1b04a0dbe87ba08674715819af473bd737742ae952a66422cace45e3c 14937 tiff_4.0.2-2.debian.tar.gz
 4cfa50e0777fbfe9115be47e1aa86c67c79f028f9ad24be79203ecb0a133456e 395214 libtiff-doc_4.0.2-2_all.deb
 c7fa3a3f28292f438dbad0c180f5f12ca4faf8d15f309fde856abf4d37281a94 233744 libtiff5_4.0.2-2_amd64.deb
 0280296a0c7e83c5919ae78f324370624984b3d5533c0ae65ccd5a7cb7953786 72918 libtiffxx5_4.0.2-2_amd64.deb
 1c5ceba5a561947140bea65f14359008153bcbca372d5e0c1b56d32bbe67edf4 375596 libtiff5-dev_4.0.2-2_amd64.deb
 6a5abebe1eb450e6c5e4677c10b7be5a43a54bf2ad3fb4e4fcdab1e0f5b0c382 295564 libtiff5-alt-dev_4.0.2-2_amd64.deb
 cb2c1cfb10aca744c15bcfb3249f917a9b0e8ba18123fb723c4c1abfe453dc88 336560 libtiff-tools_4.0.2-2_amd64.deb
 628c4f47c3ce0728407e7a4017e0290af2a80274f6be5bd5bbf1fccf34e99ce7 78588 libtiff-opengl_4.0.2-2_amd64.deb
Files: 
 8b2678f0960406b80693a0e8ebd85023 2124 libs optional tiff_4.0.2-2.dsc
 e3869080ea931a92a36499d5e02e1fd1 14937 libs optional tiff_4.0.2-2.debian.tar.gz
 f2b0fde938c1369692e1b67114433a86 395214 doc optional libtiff-doc_4.0.2-2_all.deb
 3fe63da7a52d26a21521fa24538ab4c4 233744 libs optional libtiff5_4.0.2-2_amd64.deb
 ef8b88a9d8907d5b0ff079073196c3fc 72918 libs optional libtiffxx5_4.0.2-2_amd64.deb
 71e818d2b88ec4a324ee24c63bccac66 375596 libdevel optional libtiff5-dev_4.0.2-2_amd64.deb
 0fb7f6c348f0067683a5e51f8a73bfd3 295564 libdevel optional libtiff5-alt-dev_4.0.2-2_amd64.deb
 71d3cf6c4d0043c11e5b09761d6e2a76 336560 graphics optional libtiff-tools_4.0.2-2_amd64.deb
 18c53ad4553321ac513b3058aefb0954 78588 graphics optional libtiff-opengl_4.0.2-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQC1oeAAoJEIp10QmYASx+/EYP/ReAsJvuGaskyWbyl+ElSvz0
TMsJbHvb7OtR2x0vxYdIYo9Hz3kGrM+8RzNlB05NN+bhPwWrznKcfh9ifaukQe9o
zRlQb20d+ePyJaDu+G0RdzDZhREbteIOuqzAceNkeRb8rtntnmZzn3qQ3RV8F3kE
IJHtczZTd61r5V4GS2dE40zHh8rKoCIZC2/XbmmnnhlQARSDVz2250seJ/J9pP5r
as1Mvb9xGvvsCOmdigMxnymJSjLl3ReBqL9aXYY3lMHYbWUV85Ga0vVCKApxWXyh
M5SySuISepNmf/9g5NLHozC7LpEquA22c4lJb/4JoG1X5h62Qlqoqlqqaaq0N7N9
idn2YYWmrKvbGiHMGEeXOBSdLMS344yFlu7qVA/rZK6aPt7L+YtIVj8eTfrZVhvI
HtN0qws/gwtMOaY+2tFsYE7By+wRPpZBTSfu2OXReHUQZAQvpLWeltCByVKmxsjM
PzqBOskR+oZKbp/8A2hb5RQ5zeTCAz69Svmiql84bf9o6uK4yr/fdA25Rv8smLWp
pNCRk9tWD5Ifn66YtKYtHEBz/cK9SQx/y5jdB7WHVexIdpCwOwf4RCBRJz6FdvcI
TPGTebQrmeHKfScUTz9nWiVXoSxuOTuu2dJt+cRVwhdzeXA944FgEVoxHsFUZbrW
kjSSSoh4p8LngAi8Aq8E
=RVzY
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.