Bug 1227158 (CVE-2024-24792) - VUL-0: CVE-2024-24792: TRACKERBUG: golang.org/x/image/tiff: parsing of a corrupt or malicious image with invalid color indices can cause a panic
Summary: VUL-0: CVE-2024-24792: TRACKERBUG: golang.org/x/image/tiff: parsing of a corr...
Status: CONFIRMED
Alias: CVE-2024-24792
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/412299/
Whiteboard:
Keywords:
Depends on: 1227165 1227166 1227167 1227168 1227169 1227170 1227164
Blocks:
  Show dependency tree / graph
 
Reported: 2024-06-28 10:57 UTC by SMASH SMASH
Modified: 2024-07-04 21:35 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-28 10:57:52 UTC 
Parsing a corrupt or malicious image with invalid color indices can cause a panic.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24792
https://www.cve.org/CVERecord?id=CVE-2024-24792
https://go.dev/cl/588115
https://go.dev/issue/67624
https://pkg.go.dev/vuln/GO-2024-2937
Comment 3 Bruno Pitrus 2024-06-28 12:53:54 UTC 
This is a build tool mainly intended to be used to be used on OBS, and nobody cares if a package maintainer denies service to themself.
Comment 4 Bruno Pitrus 2024-06-28 12:54:18 UTC 
Sorry, closed wrong bug.
Comment 5 Matthias Bach 2024-07-04 20:50:02 UTC 
Fix is on its way for Tumblweed. What's kind of block me for Leap is that there's still a previous maintenance request [1] in the pipeline and I am somewhat unsure about all the things I will break if I now trigger a second one before that is shipped.

[1]: https://build.opensuse.org/project/show/openSUSE:Maintenance:18435
Comment 6 OBSbugzilla Bot 2024-07-04 21:35:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1227158) was mentioned in
https://build.opensuse.org/request/show/1185695 Factory / keybase-client