A stack-based buffer overflow vulnerability was found in libtiff when running tiffslpit on crafted tiff file. Reproducer: https://github.com/asarubbo/poc/blob/master/00104-libtiff-stackoverflow-_TIFFVGetField CVE assignment: http://seclists.org/oss-sec/2017/q1/10 Reference: https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow-in-_tiffvgetfield-tif_dir-c/
Created libtiff tracking bugs for this issue: Affects: fedora-all [bug 1410123]
Created mingw-libtiff tracking bugs for this issue: Affects: fedora-all [bug 1410124] Affects: epel-7 [bug 1410125]
*** This bug has been marked as a duplicate of bug 1294417 ***
(In reply to Huzaifa S. Sidhpurwala from comment #6) > > *** This bug has been marked as a duplicate of bug 1294417 *** What is the reasoning behind this decision? Bug 1294417 references CVE-2015-7554 which affects libtiff 4.0.6. This vulnerability was found in libtiff 4.0.7.
(In reply to carl_song from comment #8) > (In reply to Huzaifa S. Sidhpurwala from comment #6) > > > > *** This bug has been marked as a duplicate of bug 1294417 *** > > What is the reasoning behind this decision? Bug 1294417 references > CVE-2015-7554 which affects libtiff 4.0.6. This vulnerability was found in > libtiff 4.0.7. CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7.
(In reply to Huzaifa S. Sidhpurwala from comment #9) > (In reply to carl_song from comment #8) > > (In reply to Huzaifa S. Sidhpurwala from comment #6) > > > > > > *** This bug has been marked as a duplicate of bug 1294417 *** > > > > What is the reasoning behind this decision? Bug 1294417 references > > CVE-2015-7554 which affects libtiff 4.0.6. This vulnerability was found in > > libtiff 4.0.7. > > CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7. If it's not fixed, why are the relevant tickets closed? Is there ongoing effort to remediate this vulnerability and how are you tracking it?
(In reply to carl_song from comment #10) > (In reply to Huzaifa S. Sidhpurwala from comment #9) > > (In reply to carl_song from comment #8) > > > (In reply to Huzaifa S. Sidhpurwala from comment #6) > > > > > > > > *** This bug has been marked as a duplicate of bug 1294417 *** > > > > > > What is the reasoning behind this decision? Bug 1294417 references > > > CVE-2015-7554 which affects libtiff 4.0.6. This vulnerability was found in > > > libtiff 4.0.7. > > > > CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7. > > If it's not fixed, why are the relevant tickets closed? Is there ongoing > effort to remediate this vulnerability and how are you tracking it? I am not sure if i understand your question. This bug (CVE-2016-10095) is marked as duplicate of CVE-2015-7554, which was fixed: Via RHSA-2016:1547 https://rhn.redhat.com/errata/RHSA-2016-1547.html in rhel-6 Via RHSA-2016:1546 https://rhn.redhat.com/errata/RHSA-2016-1546.html in rhel-7
(In reply to Huzaifa S. Sidhpurwala from comment #11) > (In reply to carl_song from comment #10) > > (In reply to Huzaifa S. Sidhpurwala from comment #9) > > > (In reply to carl_song from comment #8) > > > > (In reply to Huzaifa S. Sidhpurwala from comment #6) > > > > > > > > > > *** This bug has been marked as a duplicate of bug 1294417 *** > > > > > > > > What is the reasoning behind this decision? Bug 1294417 references > > > > CVE-2015-7554 which affects libtiff 4.0.6. This vulnerability was found in > > > > libtiff 4.0.7. > > > > > > CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7. > > > > If it's not fixed, why are the relevant tickets closed? Is there ongoing > > effort to remediate this vulnerability and how are you tracking it? > > I am not sure if i understand your question. This bug (CVE-2016-10095) is > marked as duplicate of CVE-2015-7554, which was fixed: > > Via RHSA-2016:1547 https://rhn.redhat.com/errata/RHSA-2016-1547.html in > rhel-6 > Via RHSA-2016:1546 https://rhn.redhat.com/errata/RHSA-2016-1546.html in > rhel-7 In consecutive statements you said: 1) CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7 2) CVE-2015-7554 was fixed Which one is true?
(In reply to Carl Song from comment #12) > > > > CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7. > > > > > > If it's not fixed, why are the relevant tickets closed? Is there ongoing > > > effort to remediate this vulnerability and how are you tracking it? > > > > I am not sure if i understand your question. This bug (CVE-2016-10095) is > > marked as duplicate of CVE-2015-7554, which was fixed: > > > > Via RHSA-2016:1547 https://rhn.redhat.com/errata/RHSA-2016-1547.html in > > rhel-6 > > Via RHSA-2016:1546 https://rhn.redhat.com/errata/RHSA-2016-1546.html in > > rhel-7 > > In consecutive statements you said: > 1) CVE-2015-7554 was not fixed in 4.0.6 and it got rediscovered in 4.0.7 > 2) CVE-2015-7554 was fixed > > Which one is true? Both :) 4.0.6 and 4.0.7 are upstream version numbers, we backport the patches to the versions shipped in Red Hat Enterprise Linux. So though upstream may not have fixed CVE-2015-7554 in 4.0.6 and later in 4.0.7 also, we backported the fix to our versions we ship. So versions are fixed, i am not sure about upstream versions here.
Statement: This flaw was found to be a duplicate of CVE-2015-7554. Please see https://access.redhat.com/security/cve/CVE-2015-7554 for information about affected products and security errata.