Bug 2004031 (CVE-2020-19131)

Summary:	CVE-2020-19131 libtiff: a buffer overflow via the "invertImage()" may lead to DoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caswilli, erik-fedora, fjansen, jwong, kaycoth, mike, nforro, phracek, rh-spice-bugs, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	The libtiff package is susceptible to a heap/buffer overflow via the "invertImage()" which may lead to a DoS. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-12 01:46:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2004032, 2004033, 2006011, 2006012, 2006530, 2006531, 2006532, 2006533, 2006534, 2006535, 2017785
Bug Blocks:	2004034

Description Marian Rehak 2021-09-14 12:00:28 UTC

Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".

External Reference:

http://bugzilla.maptools.org/show_bug.cgi?id=2831

Comment 1 Marian Rehak 2021-09-14 12:01:01 UTC

Created libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2004033]


Created mingw-libtiff tracking bugs for this issue:

Affects: fedora-all [bug 2004032]

Comment 4 devthomp 2021-09-21 19:50:36 UTC

Patch: (Please see the commit on this mr):
https://gitlab.com/libtiff/libtiff/-/merge_requests/61

Comment 11 errata-xmlrpc 2022-05-10 13:34:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1810 https://access.redhat.com/errata/RHSA-2022:1810

Comment 12 Product Security DevOps Team 2022-05-12 01:46:02 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-19131