Bug 189934 - CVE-2006-2024 multiple libtiff issues (CVE-2006-2025, CVE-2006-2026)
CVE-2006-2024 multiple libtiff issues (CVE-2006-2025, CVE-2006-2026)
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: libtiff (Show other bugs)
5
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Matthias Clasen
source=vendorsec,reported=20060411,pu...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-25 17:23 EDT by Josh Bressers
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-12 11:46:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2006-04-25 17:23:38 EDT
+++ This bug was initially created as a clone of Bug #189933 +++

Several libtiff issues were reported upstream in this bug:
http://bugzilla.remotesensing.org/show_bug.cgi?id=1102

Here is the changelog information for these issues (mangled to groups issues
together).  The dates are as such:

2006-03-07  Andrey Kiselev  <dron@ak4719.spb.edu>
2006-03-03  Andrey Kiselev  <dron@ak4719.spb.edu>


Denial of service
-----------------
    * libtiff/tif_dirread.c: Fixed error reporting in TIFFFetchAnyArray()
    function

    * libtiff/{tif_lzw.c, tif_pixarlog.c, tif_zip.c}: Use
    TIFFPredictorCleanup() in codec cleanup methods.

    * libtiff/{tif_jpeg.c, tif_pixarlog.c, tif_fax3.c, tif_zip.c}:
    Properly restore setfield/getfield methods in cleanup functions.

    * libtiff/{tif_predict.c, tif_predict.h}: Added new function
    TIFFPredictorCleanup() to restore parent decode/encode/field methods.

Integer Overflow
----------------
    * libtiff/tif_dirread.c: Fixed integer overflow condition in
    TIFFFetchData() function.

    * libtiff/tif_dirread.c: More wise check for integer overflow
    condition

Double Free
-----------
    * libtiff/{tif_jpeg.c, tif_pixarlog.c, tif_fax3.c, tif_zip.c}:
    Properly restore setfield/getfield methods in cleanup functions.

    Only the tif_jpeg.c patch has been shown to cause a double free issue.
    This block is the same as the one in the DoS section, just copied here for
    the double free description.

The quick testing I did consisted of running tiffinfo over the reproducers in
the upstream bug, only the attachment in comments #1, #2, and #4 crashed on FC4
(I didn't have a FC4 machine handy to test).  A source analysis may be needed to
verify all these issues.

-- Additional comment from bressers@redhat.com on 2006-04-25 17:20 EST --
Created an attachment (id=128227)
Patch extracted from upstream CVS
Comment 1 Matthias Clasen 2006-04-27 12:14:21 EDT
I have built 
libtiff-3.5.7-30.el2.1 (RHEL2.1)
libtiff-3.5.7-25.el3.1 (RHEL3) 
libtiff-3.6.1-10 (RHEL4)
with the fixes

Comment 2 Marcus Grando 2006-04-28 14:52:28 EDT
Can someone provide update to FC3?
Comment 4 Josh Bressers 2006-05-12 11:46:30 EDT
This was fixed in FEDORA-2006-474 for FC4 and FEDORA-2006-473 for FC5

Updates for FC3 willbe handled by the fedora legacy project.

Note You need to log in before you can comment on or make changes to this bug.