|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-1: CVE-2016-3619: tiff: Out-of-bounds Read in the bmp2tiff tool (none packing) | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Johannes Segitz <jsegitz> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Minor | ||
| Priority: | P4 - Low | CC: | abergmann, mvetter, pgajdos, smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/166618/ | ||
| Whiteboard: | CVSSv2:SUSE:CVE-2016-3619:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2016-3619:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2016-3619:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2016-3619:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) maint:released:sle10-sp3:64181 | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Johannes Segitz
2016-04-07 09:09:21 UTC
bugbot adjusting priority http://bugzilla.maptools.org/show_bug.cgi?id=2567#c1 Closing as wontfix since bmp2tiff has been removed from libtiff Look at the difference between 4.0.6/tools/bmp2tiff.c and 4.0.9/tools/bmp2tiff.c in 12 we maintain for backward compatibility:
--- tiff-4.0.6/tools/bmp2tiff.c 2015-08-29 00:17:08.133699639 +0200
+++ tiff-4.0.9/tools/bmp2tiff.c 2018-11-13 13:41:11.063154786 +0100
@@ -1,4 +1,4 @@
-/* $Id: bmp2tiff.c,v 1.27 2015-08-19 02:31:04 bfriesen Exp $
+/* $Id$
*
* Project: libtiff tools
* Purpose: Convert Windows BMP files in TIFF.
@@ -693,7 +693,11 @@ main(int argc, char* argv[])
}
i = 0;
j = 0;
- if (info_hdr.iBitCount == 8) { /* RLE8 */
+ if (info_hdr.iBitCount > 8) {
+ TIFFError(infilename, "Handle of this type image is not implemented");
+ goto bad;
+ }
+ else if (info_hdr.iBitCount == 8) { /* RLE8 */
while(j < uncompr_size && i < compr_size) {
if ( comprbuf[i] ) {
runlength = comprbuf[i++];
@@ -771,6 +775,14 @@ main(int argc, char* argv[])
_TIFFfree(comprbuf);
+ /* Check whether we are not going to read past the uncompressed data */
+ if ( length > j || width > j || length * width > j) {
+ TIFFError(infilename,
+ "Premature end of file");
+ _TIFFfree(uncomprbuf);
+ goto bad3;
+ }
+
for (row = 0; row < length; row++) {
if (TIFFWriteScanline(out,
uncomprbuf + (length - row - 1) * width,
For 3.8.2, without tiff-bmp2tiff.c-update.patch I get:
Breakpoint 3, main (argc=5, argv=0x7fffffffe918) at bmp2tiff.c:687
687 for (row = 0; row < length; row++) {
(gdb) p length
$5 = 1
(gdb) p j
$6 = 476
(gdb) p width
$7 = 1114112
(gdb) p length > j || width > j || length * width > j
$9 = 1
(gdb)
Thus this issue is already fixed by tiff-bmp2tiff.c-update.patch in 11/tiff and 10sp3/tiff and it is not present in 12/tiff.
Will amend rpm changelog for: 11,10sp3/tiff. I believe all fixed. SUSE-SU-2018:3879-1: An update that fixes 11 vulnerabilities is now available. Category: security (moderate) Bug References: 1010163,1014461,1040080,1040322,1074186,1099257,1113672,974446,974447,974448,983440 CVE References: CVE-2015-8870,CVE-2016-3619,CVE-2016-3620,CVE-2016-3621,CVE-2016-5319,CVE-2016-9273,CVE-2017-17942,CVE-2017-9117,CVE-2017-9147,CVE-2018-12900,CVE-2018-18661 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Server 11-SP4 (src): tiff-3.8.2-141.169.22.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): tiff-3.8.2-141.169.22.1 An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2018-12-25. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/64180 released |