Re: CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro

[Jan Lieskovsky <jlieskov () redhat com>]

Hello vendors,

  since Kurt asked for it, below is the summary of the issues.

> Hello Kurt, Steve, vendors,
>
>   Pedro Ribeiro has recently reported the following five security
> flaws being present in the tools of TIFF library:
>   [1] http://www.asmail.be/msg0055359936.html

* Issue #1 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when reading GIF extension block on 
crafted GIF image
* Issue #2 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when decoding a GIF raster image
* Issue #3 (tools/gif2tiff.c): Stack-based buffer overflow in the gif2tiff tool when decoding a GIF raster image (same 
routine like
                               in case #2, just different line code)
* Issue #4 (tools/tiff2pdf.c): Use after free in tiff2pdf tool when reading TIFF file raster image data and writing 
them to the output PDF XObject's
                               image dictionary stream
* Issue #5 (tools/rgb2ycbcr.c): Stack-based buffer overflow in the rgb2ycbcr tool when performing RGBA to YCbCr 
conversion (converting
                                non-YCbCr TIFF image to a YCbCr one) when processing crafted rasted date of provided 
TIFF image file

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> While they are present in the tools (=> not that urgent like they
> would be in the library itself), there's been CVE ids assigned
> in the past for TIFF library tools issues too. To mention some examples:
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4564
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3401
>
> Since there doesn't seem to be CVE identifiers assigned for these
> [1] issues yet, could you allocate them?
>
> FWIW regarding the patches and upstream bugs - if my information
> is up2date, there aren't upstream bugs and patches for these issues
> yet.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team