We use libtiff 4.0.6 in PDFium also; filing a separate bug for that: https://bugs.chromium.org/p/chromium/issues/detail?id=690124

I'm calling this Security_Severity-Medium out of an abundance of caution: Maybe it's more than a NULL deref, and/or maybe libtiff is used in more places than renderers in ChromeOS. Feel free to downgrade it as appropriate.

jorgelo: If you are not a good person to take this, please reassign it. Thanks!

Oh man I don't even know where we might use libtiff (outside of Chrome's PDFium). Will check.

 Issue 690404  has been merged into this issue.

 Issue 690858  has been merged into this issue.

jorgelo: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Current status: no progress.

 Issue 699951  has been merged into this issue.

jorgelo: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

According to https://packages.gentoo.org/packages/media-libs/tiff, 4.0.7 is available on Gentoo, but I don't seem to be able to update to it using cros_portage_upgrade. Mike, any ideas? Feel free to reassign to me if this is actually possible with cros_portage_upgrade.

it's due to EAPI=6.  cros_portage_upgrade won't help atm :/.

Alternatively, if I can follow instructions somewhere even without cros_portage_update, feel free to reassign to me too.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/279cce86370f3172495df330d796b69ba0504194

commit 279cce86370f3172495df330d796b69ba0504194
Author: Mike Frysinger <vapier@chromium.org>
Date: Fri Mar 17 03:30:48 2017

tiff: version bump to 4.0.7

BUG= chromium:689931 
TEST=precq passes

Change-Id: Ia227380eea0ca16ec23aee9c195f4519949607b9
Reviewed-on: https://chromium-review.googlesource.com/455156
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>

[modify] https://crrev.com/279cce86370f3172495df330d796b69ba0504194/media-libs/tiff/Manifest
[rename] https://crrev.com/279cce86370f3172495df330d796b69ba0504194/media-libs/tiff/tiff-4.0.7.ebuild
[delete] https://crrev.com/58ff61cf02b45842663b60722cea782c27af18db/media-libs/tiff/files/tiff-4.0.6-gif2tiff_removal.patch

looks like the only exposure we have w/tiff in CrOS is via sane-backends as part of the lorgnette backend

cherry picking back to R58 should be easy, and the ChangeLog for 4.0.6->4.0.7 doesn't look too bad.  back to R57 might be more work as that's using tiff-4.0.3, but maybe we want to upgrade that to 4.0.7 too ?

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Your change meets the bar and is auto-approved for M58. Please go ahead and merge the CL to branch 3029 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/098a6c21ba556a65aa978866a636b2cb903cf8f7

commit 098a6c21ba556a65aa978866a636b2cb903cf8f7
Author: Mike Frysinger <vapier@chromium.org>
Date: Mon Mar 20 01:28:59 2017

tiff: version bump to 4.0.7

BUG= chromium:689931 
TEST=precq passes

Change-Id: Ia227380eea0ca16ec23aee9c195f4519949607b9
Reviewed-on: https://chromium-review.googlesource.com/455156
(cherry picked from commit 279cce86370f3172495df330d796b69ba0504194)
Reviewed-on: https://chromium-review.googlesource.com/456680
Commit-Queue: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>

[modify] https://crrev.com/098a6c21ba556a65aa978866a636b2cb903cf8f7/media-libs/tiff/Manifest
[rename] https://crrev.com/098a6c21ba556a65aa978866a636b2cb903cf8f7/media-libs/tiff/tiff-4.0.7.ebuild
[delete] https://crrev.com/c311cbc3ddddbba30f8f66ee4de4968042698a1e/media-libs/tiff/files/tiff-4.0.6-gif2tiff_removal.patch

BTW, PDFium has a copy of libtiff and we are still carrying some patches against our copy of 4.0.7: https://pdfium-review.googlesource.com/3117

Do you want to open a separate bug for that Lei? Or do you want to track it here?

you're saying there's security fixes for 4.0.7 above what upstream has released ?  or they're hardening changes we've done on the pdfium side beyond upstream ?

Can you open a new bug?

We haven't been the best about upstreaming fixes. Most of the patches carried in PDFium's libtiff are for memory leaks. The security bugs are 0006 for bug 618267 and  0017  for  bug 681300 .

Filed  issue 703757 

 Issue 688312  has been merged into this issue.

 Issue 688313  has been merged into this issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot