From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Libtiff CVE-2016-5652 Date: Sun, 30 Oct 2016 22:56:41 +0100 Message-ID: <87h97tsdpi.fsf@gnu.org> References: <20161029234132.GA23900@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:59271) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c0y5w-0006ru-5r for guix-devel@gnu.org; Sun, 30 Oct 2016 17:56:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c0y5s-0006ns-2b for guix-devel@gnu.org; Sun, 30 Oct 2016 17:56:48 -0400 In-Reply-To: <20161029234132.GA23900@jasmine> (Leo Famulari's message of "Sat, 29 Oct 2016 19:41:32 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari skribis: > I read this 3rd party security advisory about libtiff: > > http://blog.talosintel.com/2016/10/LibTIFF-Code-Execution.html > > This patch fixes CVE-2016-5652, which is a buffer overflow with > potential for remote code execution. > > You can easily view the commit in this unofficial Git mirror of the > libtiff CVS repo: > https://github.com/vadz/libtiff/commit/b5d6803f0898e931cf772d3d0755704ab8= 488e63 > > Unfortunately, that's the closest thing to an "official" upstream > reference to the bug that is viewable in a web browser that I can find. But now you master CVS anyway, don=E2=80=99t you? ;-) > I had to also take the previous change to the affected file, since the > bug fix commit depended on those changes. > > This patched libtiff does _seem_ to work properly; I viewed a TIFF file > with it. > > One of the bugs in that Talos advisory, CVE-2016-8331, is apparently > still not fixed upstream. And CVE-2016-5875 appears to me to be fixed by > our patch for CVE-2016-5314 [0]. Hmm. > From 7abe86a8d93e1a1ed11f14ec7ede22ce9b020611 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Sat, 29 Oct 2016 19:23:05 -0400 > Subject: [PATCH] gnu: libtiff: Fix CVE-2016-5652. > > * gnu/packages/patches/libtiff-CVE-2016-5652.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/image.scm (libtiff/fixed)[source]: Use it. I=E2=80=99d say go for it. 0 days since the last image library vulnerability=E2=80=A6 Thank you! Ludo=E2=80=99.