First Last Prev Next    This bug is not in your last search results.
Bug 1033113 - (CVE-2017-7599) VUL-0: CVE-2017-7599: tiff: "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service
(CVE-2017-7599)
VUL-0: CVE-2017-7599: tiff: "outside the range of representable values of ty...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/183189/
CVSSv2:NVD:CVE-2017-7599:6.8:(AV:N/AC...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-04-10 05:57 UTC by Victor Pereira
Modified: 2019-01-14 08:07 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2017-04-10 05:57:42 UTC 
CVE-2017-7599

LibTIFF 4.0.7 has an "outside the range of representable values of type short"
undefined behavior issue, which might allow remote attackers to cause a denial
of service (application crash) or possibly have unspecified other impact via a
crafted image.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7599
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7599
Comment 1 Swamp Workflow Management 2017-10-03 19:07:50 UTC 
openSUSE-SU-2017:2635-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805
CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404
Sources used:
openSUSE Leap 42.3 (src):    tiff-4.0.8-21.1
openSUSE Leap 42.2 (src):    tiff-4.0.8-17.6.1
Comment 3 Petr Gajdos 2018-05-14 16:45:12 UTC 
CVE-2017-7596 (bug 1033126), CVE-2017-7597 (bug 1033120), CVE-2017-7599 (bug 1033113) and CVE-2017-7600 (bug 1033112) share the commit.
Comment 4 Petr Gajdos 2018-05-15 11:57:01 UTC 
12/tiff

$ tiffcp -i 00117-libtiff-outside-short-tif_dirwrite /tmp/foo
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 2583 (0xa17) encountered.
TIFFFetchNormalTag: Warning, Sanity check on size of "DocumentName" value failed; tag ignored.
TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 2583" value failed; tag ignored.
TIFFFetchNormalTag: Warning, incorrect count for field "PageNumber", expected 2, got 2.
TIFFFetchNormalTag: Warning, Incompatible type for "Software"; tag ignored.
TIFFReadDirectory: Warning, TIFF directory is missing required "StripByteCounts" field, calculating from imagelength.
TIFFFillStrip: Read error on strip 0; got 18446494488865014140 bytes, expected 2.
TIFFWriteDirectoryTagCheckedRational: Not-a-number value is illegal.
TIFFWriteDirectoryTagCheckedRational: Not-a-number value is illegal.
$

11/tiff

$ tiffcp -i 00117-libtiff-outside-short-tif_dirwrite /tmp/foo
00117-libtiff-outside-short-tif_dirwrite: This is a BigTIFF file.  This format not supported
by this version of libtiff..
$
[testcase does not work]


PATCH

see comment 2

12/ImageMagick: has it in via version update
11/ImageMagick: considering affected by this CVE set


AFTER

11/ImageMagick

$ tiffcp -i 00117-libtiff-outside-short-tif_dirwrite /tmp/foo             
00117-libtiff-outside-short-tif_dirwrite: This is a BigTIFF file.  This format not supported
by this version of libtiff..
$
Comment 5 Petr Gajdos 2018-05-15 11:57:36 UTC 
Will submit for 11/tiff and 10sp3/tiff.
Comment 6 Petr Gajdos 2018-05-18 11:09:07 UTC 
Packages submitted:
12/tiff:    165341
11/tiff:    165349
10sp3/tiff: 165350

@Michael, after you review these requests and after you accept and resubmit packages in case everything's ok, I think you can reassign this bug to security-team@.
Comment 7 Michael Vetter 2018-05-22 09:22:15 UTC 
Thanks a lot Petr! All perfect.

SR#165480 to SLE12.
SR#165482 to SLE11.
SR#165483 to SLE10.
Comment 9 Swamp Workflow Management 2018-05-30 09:05:17 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2018-06-13.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64044
Comment 10 Swamp Workflow Management 2018-05-30 13:14:45 UTC 
SUSE-SU-2018:1472-1: An update that solves 14 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1017694,1031250,1031254,1033109,1033111,1033112,1033113,1033120,1033126,1033127,1033129,1074317,984808,984809,984831,987351
CVE References: CVE-2016-10267,CVE-2016-10269,CVE-2016-10270,CVE-2016-5314,CVE-2016-5315,CVE-2017-18013,CVE-2017-7593,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Server 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    tiff-3.8.2-141.169.6.1
Comment 11 Marcus Meissner 2019-01-14 08:07:46 UTC 
done
First Last Prev Next    This bug is not in your last search results.