[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5EDB84F4B23F5B4DB6500A89258280E0BB6272@EX02.corp.qihoo.net>
Date: Wed, 15 Jun 2016 02:32:46 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-5316: libtiff 4.0.6 tif_pixarlog.c: PixarLogCleanup()
Segmentation fault
Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: illegel read
Vendor URL: http://www.remotesensing.org/libtiff/
CVE ID: CVE-2016-5316
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
Introduction
=======
Segmentation fault ocurrs in PixarLogCleanup() in tif_pixarlog.c when using rgb2ycbcr tool followed a crafted TIFF image. Attackers cound exploit this issue to cause denial-of-service.
Here is the stack info:
gdb –args ./rgb2ycbcr PixarLogCleanup.tif tmpout.tif
--- ---
Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x75757575) at malloc.c:2952
2952 if (chunk_is_mmapped (p)) /* release mmapped memory. */
Missing separate debuginfos, use: dnf debuginfo-install libjpeg-turbo-1.4.1-2.fc23.i686 zlib-1.2.8-9.fc23.i686
(gdb) bt
#0 __GI___libc_free (mem=0x75757575) at malloc.c:2952
#1 0xb7df0a4c in zcfree () from /usr/lib/libz.so.1
#2 0xb7dedd3e in inflateEnd () from /usr/lib/libz.so.1
#3 0xb7f72044 in PixarLogCleanup (tif=0x804f148) at tif_pixarlog.c:1264
#4 0xb7ec29ae in TIFFReadDirectory (tif=0x804f148) at tif_dirread.c:3412
#5 0x0804942d in main (argc=3, argv=0xbffff3a4) at rgb2ycbcr.c:132
References:
[1] http://www.remotesensing.org/libtiff/
Thank you!
Best Regards,
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
