Bug 1326267 (CVE-2016-3634) - CVE-2016-3634 libtiff: out-of-bounds read in the tagCompare function
Summary: CVE-2016-3634 libtiff: out-of-bounds read in the tagCompare function
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-3634
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1316876 (view as bug list)
Depends On:
Blocks: 1316881
TreeView+ depends on / blocked
 
Reported: 2016-04-12 09:47 UTC by Andrej Nemec
Modified: 2021-02-17 04:04 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-05-12 06:26:26 UTC


Attachments (Terms of Use)

Description Andrej Nemec 2016-04-12 09:47:58 UTC
A vulnerability was found in the libtiff library. Using the tagCompare function with the thumbnail command on a maliciously crafted tif file could cause the application to crash.

Vulnerable code:

/libtiff/tif_dirinfo.c: 341

tagCompare(const void* a, const void* b)

337{
338          const TIFFField* ta = *(const TIFFField**) a;
339          const TIFFField* tb = *(const TIFFField**) b;
340          /* NB: be careful of return values for 16-bit platforms */
341          if (ta->field_tag != tb->field_tag)
342                         return (int)ta->field_tag - (int)tb->field_tag;
343          else
344                         return (ta->field_type == TIFF_ANY) ?
345                                         0 : ((int)tb->field_type - (int)ta->field_type);
346}

References:

http://www.openwall.com/lists/oss-security/2016/04/08/13

Comment 1 Stefan Cornelius 2017-05-11 08:06:30 UTC
*** Bug 1316876 has been marked as a duplicate of this bug. ***

Comment 3 Stefan Cornelius 2017-05-12 06:26:35 UTC
Statement:

This issue did not affect the versions of libtiff as shipped with Red Hat Enterprise Linux 5, 6 and 7. This issue did not affect the versions of compat-libtiff3 as shipped with Red Hat Enterprise Linux 7.


Note You need to log in before you can comment on or make changes to this bug.