Bug 1227158 (CVE-2024-24792)

Summary:	VUL-0: CVE-2024-24792: TRACKERBUG: golang.org/x/image/tiff: parsing of a corrupt or malicious image with invalid color indices can cause a panic
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	CONFIRMED ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	camila.matos, marix
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/412299/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1227165, 1227166, 1227167, 1227168, 1227169, 1227170, 1227164
Bug Blocks:

Description SMASH SMASH 2024-06-28 10:57:52 UTC

Parsing a corrupt or malicious image with invalid color indices can cause a panic.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24792
https://www.cve.org/CVERecord?id=CVE-2024-24792
https://go.dev/cl/588115
https://go.dev/issue/67624
https://pkg.go.dev/vuln/GO-2024-2937

Comment 3 Bruno Pitrus 2024-06-28 12:53:54 UTC

This is a build tool mainly intended to be used to be used on OBS, and nobody cares if a package maintainer denies service to themself.

Comment 4 Bruno Pitrus 2024-06-28 12:54:18 UTC

Sorry, closed wrong bug.

Comment 5 Matthias Bach 2024-07-04 20:50:02 UTC

Fix is on its way for Tumblweed. What's kind of block me for Leap is that there's still a previous maintenance request [1] in the pipeline and I am somewhat unsure about all the things I will break if I now trigger a second one before that is shipped.

[1]: https://build.opensuse.org/project/show/openSUSE:Maintenance:18435

Comment 6 OBSbugzilla Bot 2024-07-04 21:35:02 UTC

This is an autogenerated message for OBS integration:
This bug (1227158) was mentioned in
https://build.opensuse.org/request/show/1185695 Factory / keybase-client