Bug 618612 (CVE-2017-5849)

Summary:	media-libs/netpbm: ITFFRGBAImageGet out-of-bounds read and write (CVE-2017-5849)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://bugzilla.maptools.org/show_bug.cgi?id=2654
See Also:	http://bugzilla.maptools.org/show_bug.cgi?id=2654
Whiteboard:	B3 [upstream cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-05-16 06:21:43 UTC

CVE-2017-5849 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5849):
  tiffttopnm in netpbm 10.47.63 does not properly use the libtiff
  TIFFRGBAImageGet function, which allows remote attackers to cause a denial
  of service (out-of-bounds read and write) via a crafted tiff image file,
  related to transposing width and height values.

Comment 1 SpanKY gentoo-dev

2018-01-30 03:53:43 UTC

netpbm maintainer (Bryan Henderson) is on the upstream bug, so going to wait for them to sort it out

Comment 2 Sam James archtester

2020-03-15 16:02:42 UTC

(In reply to SpanKY from comment #1)
> netpbm maintainer (Bryan Henderson) is on the upstream bug, so going to wait
> for them to sort it out

new upstream links:
https://gitlab.com/libtiff/libtiff/-/issues/76
https://gitlab.com/libtiff/libtiff/-/issues/77