Bugzilla Bug 67783

OpenPKG found those packages containing a vulnerable libtiff. We *might* be
affected as well :

pdflib 6.0.0p1 (http://www.pdflib.com/)
    contains an embedded libtiff version 3.6.1, but unfortunately a
    rather heavy adjusted one. So, large parts of the existing patches do
    not apply.

wxGTK 2.4.2 (http://www.wxwidgets.org/)
    contains libtiff version 3.5.201

Povray 3.6.1 (http://www.povray.org/)
    contains libtiff version 3.6.1

Preanalysis for povray :

povray-3.5 (stable) is not vulnerable [linked dynamically to libtiff]
checking for TIFFSetWarningHandler in -ltiff... yes
# ldd /usr/bin/povray | grep tiff
libtiff.so.3 => /usr/lib/libtiff.so.3 (0x40096000)

povray-3.6.1 (~) is vulnerable if built while an old libtiff was installed [builds its own libtiff and statically links to it] :
checking for library containing TIFFGetVersion... -ltiff
checking tiffio.h usability... yes
checking tiffio.h presence... yes
checking for tiffio.h... yes
checking for libtiff version >= 3.6.1... 3.5.7, bad
configure: libtiff will be built and statically linked to POV-Ray

Preanalysis for wxGTK :

Looks dynamically linked to me :

# ldd /usr/lib/libwx_gtk2* | grep libtiff
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x409a8000)
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x409a8000)
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x409a8000)
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x404d2000)
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x404d2000)
        libtiff.so.3 => /usr/lib/libtiff.so.3 (0x404d2000)

Preanalysis for pdflib:

Current version doesn't depend on tiff... and includes libtiff files. So it's probably vulnerable. If it's as adjusted as the OpenPKG guy says, we might have difficulties patching this.

Pulling in morfic to fix povray :

povray-3.6.1 includes a vulnerable libtiff, and it compiles it statically in povray if the shared tiff library at compile time is <3.6.1. So I think we need to force a tiff>=3.6.1 dep on povray-3.6.1 (+ revbump to force upgrade) so as to to be sure it won't contain a vulnerable tiff library in any case.

Please note this is still confidential, pending OpenPKG advisory release.

About pdflib, could klieber or solar ask on vendor-sec if OpenPKG has already
reported the issue upstream ?

Given the customized nature of their libtiff it's quite dangerous to try to
apply libtiff patches directly, and I think they should know. They will
probably only patch pdflib6, but hopefully their patches could be applied to
pdflib5 too.

wxGTK is public, created another bug to fix/dismiss it.

morfic: please fix povray as per comment #4
Created bug 69043 to track pdflib specifically.

povray-3.6.1-r1 is in portage, povray-3.6.1 is removed

Affected version is in ~ so no GLSA issued