Bug 677408 (CVE-2018-5360)

Summary:	<media-libs/tiff-4.0.7: mishandles the reading of TIFF files
Product:	Gentoo Security	Reporter:	D'juan McDonald (domhnall) <flopwiki>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://bugzilla.maptools.org/show_bug.cgi?id=2500
Whiteboard:	A3 [noglsa cve]
Package list:		Runtime testing required:	---

Description D'juan McDonald (domhnall) 2019-02-07 07:51:36 UTC

(https://nvd.nist.gov/vuln/detail/CVE-2018-5360):

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27

@maintainer(s): please confirm if fixed in 739dcd28, https://gitlab.com/libtiff/libtiff/commit/739dcd28a061738b317c1e9f91029d9cbc157159 is applied to 3.9.7-r1.


Gentoo Security Padawan
(domhnall)

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2019-03-26 19:16:40 UTC

Summary reflects what version it was fixed in, but this bug was filed well after the fact.