|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-1: CVE-2017-9404: libtiff: Memory leak in OJPEGReadHeaderInfoSecTablesQTable | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Victor Pereira <vpereira> |
| Component: | Incidents | Assignee: | Michael Vetter <mvetter> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Minor | ||
| Priority: | P4 - Low | CC: | abergmann, mvetter, pgajdos, smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/186221/ | ||
| Whiteboard: | CVSSv3:SUSE:CVE-2017-9404:4.0:(AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVSSv2:SUSE:CVE-2017-9404:2.1:(AV:L/AC:L/Au:N/C:N/I:N/A:P) CVSSv3:RedHat:CVE-2017-9404:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) CVSSv2:NVD:CVE-2017-9404:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2017-9404:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Victor Pereira
2017-06-06 06:12:29 UTC
SUSE-SU-2017:2569-1: An update that fixes 14 vulnerabilities is now available. Category: security (moderate) Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805 CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Server 12-SP2 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Desktop 12-SP3 (src): tiff-4.0.8-44.3.1 SUSE Linux Enterprise Desktop 12-SP2 (src): tiff-4.0.8-44.3.1 openSUSE-SU-2017:2635-1: An update that fixes 14 vulnerabilities is now available. Category: security (moderate) Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805 CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404 Sources used: openSUSE Leap 42.3 (src): tiff-4.0.8-21.1 openSUSE Leap 42.2 (src): tiff-4.0.8-17.6.1 4.0.10, 4.0.9 with ASAN $ tiff2ps memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif > /dev/null TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 552 (0x228) encountered. TIFFReadDirectory: Warning, Unknown field with tag 4625 (0x1211) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "SubfileType"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "YResolution"; tag ignored. _TIFFVSetField: memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Bad value 0 for "ResolutionUnit" tag. TIFFFetchNormalTag: Warning, Incorrect count for "JpegInterchangeFormat"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "JpegInterchangeFormatLength"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "JpegRestartInterval"; tag ignored. TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 4625" value failed; tag ignored. TIFFFetchNormalTag: Warning, incorrect count for field "YCbCrSubsampling", expected 2, got 66. TIFFFetchNormalTag: Warning, Incorrect count for "YCbCrPositioning"; tag ignored. TIFFSetField: memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Unknown pseudo-tag 65538. memory-leak-OJPEGReadHeaderInfoSecTablesQTable-tiff2ps-1.tif: Inconsistent value of es: 0. $ 3.8.2: valgrind does not show any memory leak either. 4.0.7:
=================================================================
==2166==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 73 byte(s) in 1 object(s) allocated from:
#0 0x7faea6c00ed0 in malloc (/usr/lib64/libasan.so.5+0xebed0)
#1 0x7faea7aa9db1 in _TIFFmalloc /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_unix.c:316
#2 0x7faea7a6fda2 in OJPEGReadHeaderInfoSecTablesQTable /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1770
#3 0x7faea7a6c3dc in OJPEGReadHeaderInfoSec /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1360
#4 0x7faea7a68f5b in OJPEGReadHeaderInfo /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:1086
#5 0x7faea7a651ea in OJPEGPreDecode /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_ojpeg.c:674
#6 0x7faea7a99f17 in TIFFStartStrip /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:1023
#7 0x7faea7a97c57 in TIFFFillStrip /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:647
#8 0x7faea7a95d20 in TIFFSeek /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:233
#9 0x7faea7a960e8 in TIFFReadScanline /usr/src/debug/tiff-4.0.7-0.x86_64/libtiff/tif_read.c:300
#10 0x55d6f509db0a in PSDataColorContig /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:2449
#11 0x55d6f509d5b7 in PSpage /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:2347
#12 0x55d6f509998f in TIFF2PS /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:1606
#13 0x55d6f509409d in main /usr/src/debug/tiff-4.0.7-0.x86_64/tools/tiff2ps.c:473
#14 0x7faea63e4fea in __libc_start_main (/lib64/libc.so.6+0x22fea)
SUMMARY: AddressSanitizer: 73 byte(s) leaked in 1 allocation(s).
This points to allocation memory for `ob' and to following changes between 4.0.7 and 4.0.8 in tiff_ojpeg.c:
@@ -1782,7 +1790,12 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF*
TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET);
p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
if (p!=64)
+ {
+ _TIFFfree(ob);
return(0);
+ }
+ if (sp->qtable[m]!=0)
+ _TIFFfree(sp->qtable[m]);
sp->qtable[m]=ob;
sp->sof_tq[m]=m;
}
@@ -1846,7 +1859,12 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF
rb[sizeof(uint32)+5+n]=o[n];
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
if (p!=q)
+ {
+ _TIFFfree(rb);
return(0);
+ }
+ if (sp->dctable[m]!=0)
+ _TIFFfree(sp->dctable[m]);
sp->dctable[m]=rb;
sp->sos_tda[m]=(m<<4);
}
@@ -1910,7 +1928,12 @@ OJPEGReadHeaderInfoSecTablesAcTable(TIFF
rb[sizeof(uint32)+5+n]=o[n];
p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
if (p!=q)
+ {
+ _TIFFfree(rb);
return(0);
+ }
+ if (sp->actable[m]!=0)
+ _TIFFfree(sp->actable[m]);
sp->actable[m]=rb;
sp->sos_tda[m]=(sp->sos_tda[m]|m);
}
While I do not see such code in 3.8.2 and given I can not reproduce the leak using valgrind there, I consider 11/tiff and 10sp3/tiff unaffected.
SLE12 only, fixed. |