Re: Libtiff CVE-2016-5652

[ludo@gnu.org (Ludovic Courtès)]

Leo Famulari <leo@famulari.name> skribis:

> I read this 3rd party security advisory about libtiff:
>
> http://blog.talosintel.com/2016/10/LibTIFF-Code-Execution.html
>
> This patch fixes CVE-2016-5652, which is a buffer overflow with
> potential for remote code execution.
>
> You can easily view the commit in this unofficial Git mirror of the
> libtiff CVS repo:
> https://github.com/vadz/libtiff/commit/b5d6803f0898e931cf772d3d0755704ab8488e63
>
> Unfortunately, that's the closest thing to an "official" upstream
> reference to the bug that is viewable in a web browser that I can find.

But now you master CVS anyway, don’t you?  ;-)

> I had to also take the previous change to the affected file, since the
> bug fix commit depended on those changes.
>
> This patched libtiff does _seem_ to work properly; I viewed a TIFF file
> with it.
>
> One of the bugs in that Talos advisory, CVE-2016-8331, is apparently
> still not fixed upstream. And CVE-2016-5875 appears to me to be fixed by
> our patch for CVE-2016-5314 [0].

Hmm.

> From 7abe86a8d93e1a1ed11f14ec7ede22ce9b020611 Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Sat, 29 Oct 2016 19:23:05 -0400
> Subject: [PATCH] gnu: libtiff: Fix CVE-2016-5652.
>
> * gnu/packages/patches/libtiff-CVE-2016-5652.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/image.scm (libtiff/fixed)[source]: Use it.

I’d say go for it.

0 days since the last image library vulnerability…

Thank you!
Ludo’.