*** This bug is a security vulnerability ***
Public security bug reported:
Jinbao Chen discovered a heap buffer overflow in
t2p_readwrite_pdf_image():
=====8<=====
We found an ASan-confirmed heap-buffer-overflow in upstream libtiff
4.5.0 `tiff2pdf`, in `tools/tiff2pdf.c:t2p_readwrite_pdf_image()`. The
issue is an integer truncation in the JPEG raw passthrough path: BigTIFF
`StripByteCounts` is read as `uint64_t`, but the maximum strip length is
stored in a `uint32_t max_striplength`. A crafted BigTIFF can cause a
small heap allocation followed by a 4GB+ raw strip copy via
`TIFFReadRawStrip(..., -1)`.
Upstream status:
- The vulnerable source pattern appears to be present in upstream v3.9.0
through v4.7.0.
- The first upstream release where this specific truncation appears fixed is
v4.7.1.
- The relevant upstream fix appears to be commit
`67fd283d276f09db54dc39b9ef7b979d4b45c4b1` / MR !729, which changes
`max_striplength` from `uint32_t` to `uint64_t` in `tools/tiff2pdf.c`.
- The upstream maintainer indicated that libtiff focuses on fixing the latest
software and making new releases, rather than repairing old versions, and
suggested that distributions carrying old versions update or handle their
packages.
=====8<=====
Upstream apparently didn't care to assign a CVE to something they have
already fixed. We tried to contact tiff upstream without success. We
tried to contact Red Hat's secalert (the CNA that has assigned a large
chunk of tiff's CVEs, as well as CNA of last resort for FOSS) without
success.
(I wanted input from others because crashes in command line utilities
aren't always given a CVE.)
** Affects: tiff (Ubuntu)
Importance: Undecided
Status: Confirmed
** Changed in: tiff (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164693
Title:
heap buffer overflow in t2p_readwrite_pdf_image()
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/2164693/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
