Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 699868 (CVE-2018-19210, CVE-2019-17546, CVE-2019-6128) - <media-libs/tiff-4.1.0: multiple vulnerabilities (CVE-{2018-19210,2019-6128,2019-17546})
Summary: <media-libs/tiff-4.1.0: multiple vulnerabilities (CVE-{2018-19210,2019-6128,2...
Status: IN_PROGRESS
Alias: CVE-2018-19210, CVE-2019-17546, CVE-2019-6128
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A3 [cleanup glsa?]
Keywords: STABLEREQ
Depends on:
Blocks:
 
Reported: 2019-11-11 18:29 UTC by GLSAMaker/CVETool Bot
Modified: 2019-12-03 00:42 UTC (History)
1 user (show)

See Also:
Package list:
media-libs/tiff-4.1.0
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-11-11 18:29:53 UTC
CVE-2018-19210 (https://nvd.nist.gov/vuln/detail/CVE-2018-19210):
  In LibTIFF 4.0.9, there is a NULL pointer dereference in the
  TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial
  of service attack, as demonstrated by tiffset.

CVE-2019-6128 (https://nvd.nist.gov/vuln/detail/CVE-2019-6128):
  The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak,
  as demonstrated by pal2rgb.
Comment 1 Agostino Sarubbo gentoo-dev 2019-11-12 10:07:54 UTC
x86 stable
Comment 2 Agostino Sarubbo gentoo-dev 2019-11-12 10:14:06 UTC
sparc stable
Comment 3 Agostino Sarubbo gentoo-dev 2019-11-12 10:16:39 UTC
s390 stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-11-12 15:09:32 UTC
ppc64 stable
Comment 5 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-11-13 01:26:19 UTC
arm64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-11-13 07:41:58 UTC
ppc stable
Comment 7 Agostino Sarubbo gentoo-dev 2019-11-13 07:44:59 UTC
amd64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-11-14 11:58:23 UTC
ia64 stable
Comment 9 Matt Turner gentoo-dev 2019-11-17 07:22:00 UTC
alpha stable
Comment 10 Rolf Eike Beer 2019-11-19 19:57:20 UTC
hppa stable
Comment 11 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-27 13:43:01 UTC
arm stable
Comment 12 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-27 13:44:09 UTC
sh stable
Comment 13 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-27 13:44:32 UTC
m68k stable
Comment 14 Thomas Deutschmann gentoo-dev Security 2019-12-03 00:42:27 UTC
@ maintainer(s): Please cleanup and drop <media-libs/tiff-4.1.0!