[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20160124180726.F02FE6C00EA@smtpvmsrv1.mitre.org>
Date: Sun, 24 Jan 2016 13:07:26 -0500 (EST)
From: cve-assign@...re.org
To: carnil@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: tiff: potential out-of-bound write in NeXTDecode()
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Could you assign a CVE for the following issue in tiff:
>
> http://bugzilla.maptools.org/show_bug.cgi?id=2508
>
>> 2015-12-27 Even Rouault <even.rouault at spatialys.com>
>>
>> * libtiff/tif_next.c: fix potential out-of-bound write in NeXTDecode()
>> triggered by http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
>> (bugzilla #2508)
>
> Fixing commit:
>
> https://github.com/vadz/libtiff/commit/b18012dae552f85dcc5c57d3bf4e997a15b1cc1c
As mentioned in the
http://openwall.com/lists/oss-security/2015/02/07/5 post, this
libtiff5.tif file was first associated with CVE-2015-1547. However,
https://bugs.mageia.org/show_bug.cgi?id=15519 is about "libtiff new
security issue (second issue from PoC for CVE-2015-1547) ... this is
actually another issue in libtiff itself." This suggests that a
separate CVE ID is useful, because there were two separate types of
problems, discovered at different times, that were triggered by the
same example .tif file. Use CVE-2015-8784.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWpQ/XAAoJEL54rhJi8gl5fHkQAJn5r1tcywWFYkpi7xgmiS7X
GZ00mtvvyl4tO13+qnLSH7Odv7wfVUaKhcdoAXbCjqvlGYwfHt93+kP/6uqjD/te
sJgo2E89yzaI+kc5p3+Ta1FubRfG/rljUyk+RnxZ1LprGf9eZ9BHV4C0ORNHyUOC
nA/UvWsbmaVZoWn2FqakcFsPA/GzcfYjBNdLPNvZe/RdUzyivm79k/VUgHz+EzbT
ERPaA5scDo7irc0jNjkerkNCuav8Wsn3nnXBVDngewQb5h0BUhjVIKhJOnOugqS6
/fNMxKj8whnhuQI9NsYlqPXo+bmLXOJWc5aoAXZD/kabMOU2zUvMguqCZChRx+GM
Ww3bYOed4b7ug0K5p8ZIeO6oP/XoInrQbPC09kvVX/xnKXXicIbxmnENVjbWOu80
lXyoRp2qI3FnaIVhHWBkRbnxWVhqlSyr2fUeu9DBW52TMVgTWnr6Ovm/9lDtv67P
JFFwTN15Zxvi6B8o2B/Rrpo6smTPWDV6D88rqF+U0wR/MZ9kJ5zHGR4tFTMUQK3J
P6cGRkSnJwhrdp6eWiaLu9EZkOwSTPBhioEoSaWG1EmzFI6gXzlmd8gGeG/XikAQ
c7oEaLuVxXhZyHBTBn+og+73FTJCdTHJLi4MgQWnErkaA9Tjzu9vNKqe4rotIiCH
eH4woIieb01417xgvS7x
=EnxA
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
