Bug 891839 – <media-libs/tiff-4.5.0-r1: heap buffer overflow in tiffcrop

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2023-01-23 14:46:03 UTC]

CVE-2022-48281 (https://gitlab.com/libtiff/libtiff/-/issues/488):

processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.

Patch: https://gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5

C given the issue is in a likely little used extra tool distributed with libtiff.

[Comment 1 John Helmert III 2023-01-25 19:02:41 UTC]

Ugh. The Gitlab issues are *filled* with issues in tiffcrop.

https://gitlab.com/libtiff/libtiff/-/issues

[Comment 2 Michael Vetter 2023-02-04 19:01:34 UTC]

I created https://github.com/gentoo/gentoo/pull/29426 with a fix for this.
It is a long time ago that I worked with ebuilds so please be patient in case I made any mistakes in my changes or in the process.

Would be happy to get some feedback and improve in case something is not right.

[Comment 3 Larry the Git Cow 2023-02-07 04:30:12 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7a7119ce544ba3de8179b4b9ec93c0032a069ecd

commit 7a7119ce544ba3de8179b4b9ec93c0032a069ecd
Author:     Michael Vetter <[e-mail]>
AuthorDate: 2023-02-04 18:56:16 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-02-07 04:29:50 +0000

    media-libs/tiff: Fix CVE-2022-48281
    
    Bug: https://bugs.gentoo.org/891839
    Upstream: https://gitlab.com/libtiff/libtiff/-/issues/488
    Signed-off-by: Michael Vetter <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/29426
    Signed-off-by: Sam James <[e-mail]>

 .../tiff/files/tiff-4.5.0-CVE-2022-48281.patch     | 14 ++++
 media-libs/tiff/tiff-4.5.0-r1.ebuild               | 90 ++++++++++++++++++++++
 2 files changed, 104 insertions(+)

[Comment 4 Sam James 2023-02-07 04:30:45 UTC]

(In reply to Michael Vetter from comment #2)
> I created https://github.com/gentoo/gentoo/pull/29426 with a fix for this.
> It is a long time ago that I worked with ebuilds so please be patient in
> case I made any mistakes in my changes or in the process.
> 
> Would be happy to get some feedback and improve in case something is not
> right.

Thank you!

[Comment 5 Larry the Git Cow 2023-05-13 21:36:47 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9250f44e52874c9bc51637f4d57c7a61a4f88063

commit 9250f44e52874c9bc51637f4d57c7a61a4f88063
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2023-05-13 21:36:06 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2023-05-13 21:36:23 +0000

    media-libs/tiff: drop 4.5.0, 4.5.0-r1
    
    Bug: https://bugs.gentoo.org/895900
    Bug: https://bugs.gentoo.org/891839
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 media-libs/tiff/tiff-4.5.0-r1.ebuild | 90 ------------------------------------
 media-libs/tiff/tiff-4.5.0.ebuild    | 89 -----------------------------------
 2 files changed, 179 deletions(-)

[Comment 6 John Helmert III 2023-05-29 04:37:50 UTC]

GLSA request filed.

[Comment 7 Larry the Git Cow 2023-05-30 03:05:36 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=d6e726fbb202042644e22b21b37486e541d63ba0

commit d6e726fbb202042644e22b21b37486e541d63ba0
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-05-30 03:01:32 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2023-05-30 03:05:03 +0000

    [ GLSA 202305-31 ] LibTIFF: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/891839
    Bug: https://bugs.gentoo.org/895900
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202305-31.xml | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

[Comment 8 John Helmert III 2023-05-30 03:08:34 UTC]

GLSA released, all done!