Bugzilla Bug 75213

Two iDEFENSE advisories should go out soon :

- libtiff STRIPOFFSETS Integer Overflow Vulnerability
- LibTIFF Directory Entry Count Integer Overflow Vulnerability

Both are fixed in upstream release 3.7.1

nerdboy: This is still semi-public, so please don't talk about it (should be public in a few hours) but please submit a new 3.7.1 ebuild silently referencing this bug.

Note to self, this might also affect :

- PDFLib (includes modified libtiff)
- kfax (includes libtiff code)
- xv (might need to be rebuilt with a new libtiff.a)

Okay, new ebuild going in portage now.  Should I remove the old ones and mark
the 
new 3.7.1 version stable on all arches?  I'm about to commit it as ~arch, and 
I'll be right back after I go turn the grades in...

This issue is now public

     http://www.idefense.com/application/poi/display?id=174

arches, please mark stable.

stable on amd64

sparc stable.

Hmm I think we'll hold on this one a little.

Apparently the 'libtiff STRIPOFFSETS Integer' is a subset of CAN-2004-0886 that has already been fixed by GLSA 200410-11.

The other one would not be exploitable except for a crash. However there is another one coming.

Removing arches for the time being, as we probably will commit a -r1 with a patch.

I'm not sure how to link these in bugzilla, but this bug 75316 seems to have
been 
introduced with the new 3.7.1 release.  I'm still researching it, so that's all 
I know so far.

Test image for the "LibTIFF Directory Entry Count Integer Overflow"
Vulnerability
ftp://ftp.altlinux.org/pvt/people/ldv/1x1.tiff

LibTIFF Directory Entry Count Integer Overflow Vulnerability is CAN-2004-1308,
see DSA 617-1.

If work doesn't progress on the other libtiff-related vuln, we'll probably go
on and release an updated tiff with only this one. Steve, you might prefer us
to wait so that you get time to sort out bug 75316 before we start asking
arches to test again. Keep us posted.

No progress on the other security issue, better unblocking this one.

Calling back arches to test and mark stable. Please pay special attention to possible transparency issues to see if you reproduce bug 75316.

The transparency bug has bitten at least two windowmaker users (confirmed via 
independent tools) so if you can, it might be better to wait and get it all 
sorted out at once.  I'm not sure if transparent faxes are a big deal, but 
there are probably other applications with a bigger need for transparency 
than security is a risk.  Or we can do it piece-meal...

stable on ppc64

Stable on alpha.

Fixes for both 75316 and 75423 are in -r1.  I guess everyone gets to test and 
mark stable as you can.  Thanks in advance.

Arches: please test and mark 3.7.1-r1 stable. It's just 3.7.1 + a bugfix on the
transparency issue and a fix on the tiffdump utility.

stable on ppc64

Tested and marked ppc stable.

sparc stable.

x86 there

Stable on mips.

Stable on alpha.

stable amd64.

Stable ppc-macos.

GLSA 200501-06
arm hppa ia64 s390 : please remember to mark stable to benefit from GLSA.