Your message dated Sun, 15 Apr 2018 19:21:51 +0000
with message-id <e1f7ndj-000ipa...@fasolo.debian.org>
and subject line Bug#869823: fixed in tiff 4.0.9-5
has caused the Debian Bug report #869823,
regarding tiff: CVE-2017-11613
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
869823: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869823
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: tiff
Version: 4.0.8-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for tiff.

CVE-2017-11613[0]:
| In LibTIFF 4.0.8, there is a denial of service vulnerability in the
| TIFFOpen function. A crafted input will lead to a denial of service
| attack. During the TIFFOpen process, td_imagelength is not checked. The
| value of td_imagelength can be directly controlled by an input file. In
| the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc
| function is called based on td_imagelength. If we set the value of
| td_imagelength close to the amount of system memory, it will hang the
| system or trigger the OOM killer.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11613
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11613
[1] https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f

Can you check if that was as well reported upstream
Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

--- End Message ---
--- Begin Message ---
Source: tiff
Source-Version: 4.0.9-5

We believe that the bug you reported is fixed in the latest version of
tiff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 869...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <g...@debian.org> (supplier of updated tiff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 15 Apr 2018 18:13:42 +0000
Source: tiff
Binary: libtiff5 libtiffxx5 libtiff5-dev libtiff-dev libtiff-tools 
libtiff-opengl libtiff-doc
Architecture: source amd64 all
Version: 4.0.9-5
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <g...@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <g...@debian.org>
Description:
 libtiff-dev - Tag Image File Format library (TIFF), development files, current
 libtiff-doc - TIFF manipulation and conversion documentation
 libtiff-opengl - TIFF manipulation and conversion tools
 libtiff-tools - TIFF manipulation and conversion tools
 libtiff5   - Tag Image File Format (TIFF) library
 libtiff5-dev - Tag Image File Format library (TIFF), development files
 libtiffxx5 - Tag Image File Format (TIFF) library -- C++ interface
Closes: 869823 883320 891288
Changes:
 tiff (4.0.9-5) unstable; urgency=high
 .
   * Fix CVE-2017-11613: avoid memory exhaustion in
     ChopUpSingleUncompressedStrip() (closes: #869823).
   * Fix CVE-2018-7456: NULL pointer dereference in TIFFPrintDirectory()
     (closes: #891288).
   * Fix CVE-2017-17095: heap-based buffer overflow in pal2rgb tool
     (closes: #883320).
   * Don't specify parallel to debhelper.
   * Update Standards-Version to 4.1.4 .
Checksums-Sha1:
 89b5b03490d29c89bdc8d29e5adbca11cfddc0ac 2184 tiff_4.0.9-5.dsc
 c7b31db61dd17d89ee488790e1c906bf8f3abce6 22864 tiff_4.0.9-5.debian.tar.xz
 bf21c77518a73eda63408a7e1a16fa4c9162d9ed 96320 libtiff-dev_4.0.9-5_amd64.deb
 0e3fa54f22ab387932fd212d1f6096d3b1697705 403280 libtiff-doc_4.0.9-5_all.deb
 c302361f0ba12dde13e789583909869425d6ed45 13752 
libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 be246ae589c9d27b5230fd3fa6704e5423937513 104848 
libtiff-opengl_4.0.9-5_amd64.deb
 e4a34497cb9bb20e7de6310b26af0ef6f635227e 348292 
libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 28b6d4ea00c51df2958a0c7657c9495b7d0aa91f 286980 libtiff-tools_4.0.9-5_amd64.deb
 f1ae499bf30e7790f59876430f7c3c5b3f2aad1f 376692 
libtiff5-dbgsym_4.0.9-5_amd64.deb
 1cb41b832591670bda407f6c3492af6f216c5472 367464 libtiff5-dev_4.0.9-5_amd64.deb
 8ccdd356549d6dd52ddf3b1d7f5e4ec3b8ded1cb 245632 libtiff5_4.0.9-5_amd64.deb
 cfb90d9bd23407bfbfb92027820c81ba880ff0e1 21268 
libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 8900e34afc3d7353bbf314a6fd93f11c412e1bf3 100044 libtiffxx5_4.0.9-5_amd64.deb
 7168331074f126952da9ea23e8efd899a3cc4dbf 12131 tiff_4.0.9-5_amd64.buildinfo
Checksums-Sha256:
 f708f46910204e0a009edd7ae709fd7c9a4b467775d36ca4160aab290c195bd6 2184 
tiff_4.0.9-5.dsc
 5c98180b77457fc5452f3b4fed85862172dbfdb342d7a98e88363e439a669c96 22864 
tiff_4.0.9-5.debian.tar.xz
 7667bb7574545c2131b7bf9c2dccd072364edd5be94d25255d6558dc64d9ef72 96320 
libtiff-dev_4.0.9-5_amd64.deb
 776955232fb4606537a2282ebbc6c307587201823cede71328e0cc5e43de987c 403280 
libtiff-doc_4.0.9-5_all.deb
 615e9c1ed3f6c89dfd43671c208a621dd1e5129ce0a97cd897255d5fbd2ba621 13752 
libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 9d95a4784b10001b736dabedfb5a5a8fd1623769bb9ae527a7e27f8ab0f1e4a0 104848 
libtiff-opengl_4.0.9-5_amd64.deb
 5022d7ae68a550a079c6ba2b8c8d632e84f828fd1006e992c1e8ce0be719ebdf 348292 
libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 1a8d88b79e690e9f504e293f8bdb224f05f2587c2ac4ee104975042ae4708430 286980 
libtiff-tools_4.0.9-5_amd64.deb
 95a97d09eb954bb0c228c9aad4f6a4f596231fa13675a444fad5a65f0e3c449e 376692 
libtiff5-dbgsym_4.0.9-5_amd64.deb
 f8585c5ffc1f8ca593ea045f760c91e5c1b2ecaffe33fd2ff35d59e29a962a54 367464 
libtiff5-dev_4.0.9-5_amd64.deb
 18778122ad6201d8edb41d1bc79fb14415ce51ee83e24d3d0b6a3230fcfbcd9d 245632 
libtiff5_4.0.9-5_amd64.deb
 8810671bfe2bd766877b4c50ef444937efaf1a2ba654acaa90b2b59270c97aa8 21268 
libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 64e79614a1a71c2f142ffb7c86a7e41a959c2d18e5bcf8ea9010c102c05d3f1b 100044 
libtiffxx5_4.0.9-5_amd64.deb
 ac2de2cc65b42ce63c39ddb3fcd06280bb801814a7264f1e9b6a284df0b6b814 12131 
tiff_4.0.9-5_amd64.buildinfo
Files:
 7c4518cdeb95460173802a748ce76c6e 2184 libs optional tiff_4.0.9-5.dsc
 22d7c422438c6270fe7ac79913f86d0d 22864 libs optional tiff_4.0.9-5.debian.tar.xz
 225464e88da83a85836b867c5d8f2ddc 96320 oldlibs optional 
libtiff-dev_4.0.9-5_amd64.deb
 99f1c8d8e02fffe5ba05493b640338cf 403280 doc optional 
libtiff-doc_4.0.9-5_all.deb
 18cedeff0aecb5e0dc19e2115c4b2b19 13752 debug optional 
libtiff-opengl-dbgsym_4.0.9-5_amd64.deb
 3c3656858197d4d71da034521c27ef8d 104848 graphics optional 
libtiff-opengl_4.0.9-5_amd64.deb
 7ef79531d8b9d189f1b1cb64ebcd21ff 348292 debug optional 
libtiff-tools-dbgsym_4.0.9-5_amd64.deb
 b413e56e2a5dcb3054fed7f30f745c67 286980 graphics optional 
libtiff-tools_4.0.9-5_amd64.deb
 4be386931aa02908e4d711ce0c09a5e0 376692 debug optional 
libtiff5-dbgsym_4.0.9-5_amd64.deb
 a0fef22485949f76a4ee3c18962d6687 367464 libdevel optional 
libtiff5-dev_4.0.9-5_amd64.deb
 b8f62d32fbfc65dafeb4c163bcefc5c7 245632 libs optional 
libtiff5_4.0.9-5_amd64.deb
 ab2901df81dc64a57bf4d653cae37cb3 21268 debug optional 
libtiffxx5-dbgsym_4.0.9-5_amd64.deb
 ccfc7dc5cea835633b9a292a621b5e48 100044 libs optional 
libtiffxx5_4.0.9-5_amd64.deb
 b932630b31e4e31e6506f79174d0c2c7 12131 libs optional 
tiff_4.0.9-5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAlrToMYACgkQ3OMQ54ZM
yL+MFxAAojHYv2PylcGrTFNGDBwDLDHjka/8aH33JCoG641qPtlZDLrtw84bPOOW
Y9I0gIA6rJzxH0ajbx6ifTlDzrO5Gon9E6R+DZqTesayjB7iw5X60vIFIqfADolt
USGOAGeU9y2oZTvNKuWXucfszJ0dRJwm7Uz2WZEkRlSQVUv8CMsa8XTk7BoTEo/2
TzDnS5OsX5jXKYZnbbakbpJNfTW+4mFdeVWBIQwhDEDD0yZ4rHr8j50F8vkASbVq
H7IwDerapBgYba7a27wOFmteDw4meeKofokJAM5b4juwlrYzLP1KKEESztLSh4K9
2cHf+vBRSPBsTasuINkW0PhLfAovsf6vkonWrkXqcOzBk8NNwOb1HXO4CO3JmADD
S2TlyXZf6kJLRzLUwZoZZXc6YgVlggDDXt0Tp88C+T5aHafqpsuC0C0bIU+0sueo
cs4QxFK6ptyEz7MQe8nW3Co27flO7CI9uXhWf85VNc1u/0cLxUXchuO1NInPgvhu
qY5pY8BzRciaz4sD1Ctx8j32LxVQjz+lPrVnUgJ6/PgxLUi+jDt1JxrfgKXLwYUz
QiBbN8WeZa1v5vehwHLkZD+bkpRAbwO4d4ojy0L3AhEDV9UwAy/06IR7FjZWuHPS
++tqaIpkbFg+9uVwJ/tm/uXdEZVlrtK6rLpgDzkFJTtovHR8DW4=
=gKts
-----END PGP SIGNATURE-----

--- End Message ---

Reply via email to