Leo Famulari <[email protected]> skribis: > I read this 3rd party security advisory about libtiff: > > http://blog.talosintel.com/2016/10/LibTIFF-Code-Execution.html > > This patch fixes CVE-2016-5652, which is a buffer overflow with > potential for remote code execution. > > You can easily view the commit in this unofficial Git mirror of the > libtiff CVS repo: > https://github.com/vadz/libtiff/commit/b5d6803f0898e931cf772d3d0755704ab8488e63 > > Unfortunately, that's the closest thing to an "official" upstream > reference to the bug that is viewable in a web browser that I can find.
But now you master CVS anyway, don’t you? ;-) > I had to also take the previous change to the affected file, since the > bug fix commit depended on those changes. > > This patched libtiff does _seem_ to work properly; I viewed a TIFF file > with it. > > One of the bugs in that Talos advisory, CVE-2016-8331, is apparently > still not fixed upstream. And CVE-2016-5875 appears to me to be fixed by > our patch for CVE-2016-5314 [0]. Hmm. > From 7abe86a8d93e1a1ed11f14ec7ede22ce9b020611 Mon Sep 17 00:00:00 2001 > From: Leo Famulari <[email protected]> > Date: Sat, 29 Oct 2016 19:23:05 -0400 > Subject: [PATCH] gnu: libtiff: Fix CVE-2016-5652. > > * gnu/packages/patches/libtiff-CVE-2016-5652.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/image.scm (libtiff/fixed)[source]: Use it. I’d say go for it. 0 days since the last image library vulnerability… Thank you! Ludo’.
