Two iDEFENSE advisories should go out soon : - libtiff STRIPOFFSETS Integer Overflow Vulnerability - LibTIFF Directory Entry Count Integer Overflow Vulnerability Both are fixed in upstream release 3.7.1 nerdboy: This is still semi-public, so please don't talk about it (should be public in a few hours) but please submit a new 3.7.1 ebuild silently referencing this bug.
Note to self, this might also affect : - PDFLib (includes modified libtiff) - kfax (includes libtiff code) - xv (might need to be rebuilt with a new libtiff.a)
Okay, new ebuild going in portage now. Should I remove the old ones and mark the new 3.7.1 version stable on all arches? I'm about to commit it as ~arch, and I'll be right back after I go turn the grades in...
This issue is now public http://www.idefense.com/application/poi/display?id=174 arches, please mark stable.
stable on amd64
sparc stable.
Hmm I think we'll hold on this one a little. Apparently the 'libtiff STRIPOFFSETS Integer' is a subset of CAN-2004-0886 that has already been fixed by GLSA 200410-11. The other one would not be exploitable except for a crash. However there is another one coming. Removing arches for the time being, as we probably will commit a -r1 with a patch.
I'm not sure how to link these in bugzilla, but this bug 75316 seems to have been introduced with the new 3.7.1 release. I'm still researching it, so that's all I know so far.
Test image for the "LibTIFF Directory Entry Count Integer Overflow" Vulnerability ftp://ftp.altlinux.org/pvt/people/ldv/1x1.tiff
LibTIFF Directory Entry Count Integer Overflow Vulnerability is CAN-2004-1308, see DSA 617-1. If work doesn't progress on the other libtiff-related vuln, we'll probably go on and release an updated tiff with only this one. Steve, you might prefer us to wait so that you get time to sort out bug 75316 before we start asking arches to test again. Keep us posted.
No progress on the other security issue, better unblocking this one. Calling back arches to test and mark stable. Please pay special attention to possible transparency issues to see if you reproduce bug 75316.
The transparency bug has bitten at least two windowmaker users (confirmed via independent tools) so if you can, it might be better to wait and get it all sorted out at once. I'm not sure if transparent faxes are a big deal, but there are probably other applications with a bigger need for transparency than security is a risk. Or we can do it piece-meal...
stable on ppc64
Stable on alpha.
Fixes for both 75316 and 75423 are in -r1. I guess everyone gets to test and mark stable as you can. Thanks in advance.
Arches: please test and mark 3.7.1-r1 stable. It's just 3.7.1 + a bugfix on the transparency issue and a fix on the tiffdump utility.
Tested and marked ppc stable.
x86 there
Stable on mips.
stable amd64.
Stable ppc-macos.
GLSA 200501-06 arm hppa ia64 s390 : please remember to mark stable to benefit from GLSA.
