New issue
Advanced search Search tips

Issue 723582 link

Starred by 2 users
Status: Fixed
Owner:
vapier@chromium.org
Closed: May 2017
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security



Sign in to add a comment

CrOS: Vulnerability reported in media-libs/tiff

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, May 17 2017 
Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: media-libs/tiff
Package Version: [cpe:/a:libtiff:libtiff:4.0.6 cpe:/a:libtiff:libtiff:4.0.7 cpe:/a:libtiff_project:libtiff:4.0.6 cpe:/a:libtiff_project:libtiff:4.0.7]

Advisory: CVE-2016-10371
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-10371
  CVSS severity score: 4.3/10.0
  Confidence: high
  Description:

The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file.

Comment 1 by wfh@chromium.org, May 18 2017

Owner: kerrnel@chromium.org
Status: Assigned (was: Untriaged)
I can't find where libtiff is used, it's not in third_party/

+kerrnel can you take a look at this?

Also, a DoS isn't a security bug.

Comment 2 by kerrnel@chromium.org, May 18 2017 

Yes, and if this is indeed a matter of triggering an assertion than this shouldn't be a security bug. A major point of assertions is to avoid corrupted state and exit.

Comment 3 by kerrnel@chromium.org, May 18 2017 

Yes, and if this is indeed a matter of triggering an assertion than this shouldn't be a security bug.

Comment 4 by kerrnel@chromium.org, May 18 2017

Owner: vapier@chromium.org
vapier@, can you look at this?

Comment 5 by vapier@chromium.org, May 22 2017

Labels: M-59 M-60 M-58
Status: Fixed (was: Assigned)
this was handled as part of the large set of patches pulled in for  issue 706349 

CVE-2016-10371 refers to upstream  bug 2535  and we pulled in the fix for that in "tiff-4.0.7- bug2535 .patch"

confirmed this is in M-58+ already
Project Member

Comment 6 by sheriffbot@chromium.org, May 23 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 7 by sheriffbot@chromium.org, Aug 29 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 8 by dchan@chromium.org, Jan 22 2018

Status: Archived (was: Fixed)

Comment 9 by vapier@chromium.org, Jun 21 2018

Status: Fixed (was: Archived)
►

Sign in to add a comment