[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTilpG-vqtlvhHUMWTw0-URx8DVyKruJwh_1J2uoi@mail.gmail.com>
Date: Tue, 29 Jun 2010 12:36:27 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: Tomas Hoger <thoger@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE requests: LibTIFF
On Tue, Jun 29, 2010 at 12:27 PM, Tomas Hoger <thoger@...hat.com> wrote:
> On Tue, 29 Jun 2010 08:05:25 -0400 Dan Rosenberg wrote:
>
>> On request, I'm re-posting the issues which I think actually deserve
>> CVE ids.
>
> I believe the disagreement here is caused by different opinions on what
> should be and what does not need to be called security.
>
I agree that it's a fine line between security and stability issues.
In these cases, since simply viewing a TIFF image will crash any
application linked against libtiff, and given a past record of DoS
issues in image libraries (and libtiff in particular) receiving CVEs,
I see no reason why these bugs should be treated any differently. In
any case, I leave that decision to those who assign CVEs.
>> 2. A NULL pointer derefrence in TIFFVGetField() may result in
>> application crash
>> (https://bugs.launchpad.net/ubuntu/lucid/+source/tiff/+bug/589145).
>
> This got CVE-2010-2443 from Mitre few days ago. But I guess you're
> going to (or should?) ask for one more for td_stripbytecount case I
> pointed out in one of the previous replies (split due to different
> fixed-in version). Sauli's fuzzer to blame for the discovery again ;).
>
In that case, we've got three CVE-pending issues, each of which have
been described in more detail in previous posts:
1. OOB read in TIFFExtractData() leading to crash.
2. NULL pointer dereference due to invalid td_stripbytecount leading
to crash (distinct from CVE-2010-2443).
3. OOB read in TIFFRGBAImageGet() leading to crash.
-Dan
> --
> Tomas Hoger / Red Hat Security Response Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
