Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1595575 - (CVE-2018-12900) CVE-2018-12900 libtiff: Heap-based buffer overflow in the cpSeparateBufToContigBuf function resulting in a denial of service or possibly code execution
CVE-2018-12900 libtiff: Heap-based buffer overflow in the cpSeparateBufToCont...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180626,repor...
: Security
Depends On: 1595576 1595577 1595578 1595579 1600430
Blocks: 1595581
  Show dependency tree / graph
 
Reported: 2018-06-27 03:48 EDT by Andrej Nemec
Modified: 2018-07-12 04:51 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Andrej Nemec 2018-06-27 03:48:55 EDT 
Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file.

Upstream issue:

http://bugzilla.maptools.org/show_bug.cgi?id=2798
Comment 1 Andrej Nemec 2018-06-27 03:49:30 EDT 
Created libtiff tracking bugs for this issue:

Affects: fedora-all [bug 1595576]


Created mingw-libtiff tracking bugs for this issue:

Affects: epel-7 [bug 1595578]
Affects: fedora-all [bug 1595577]
Comment 3 Riccardo Schirone 2018-07-12 04:22:46 EDT 
Raised CVSSv3 to 5.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L because I do not exclude something more than a simple crash is possible with this flaw. Indeed you can overwrite many bytes after the limits of an heap-allocated buffer, thus code execution through heap manipulation is not excluded.
Comment 5 Riccardo Schirone 2018-07-12 04:42:43 EDT 
The flaw is in the tiffcp binary and not in the libtiff library, thus programs that use libtiff are not affected.
Comment 7 Riccardo Schirone 2018-07-12 04:51:39 EDT 
Patch is not available upstream yet.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.