January 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1017690] VUL-0: CVE-2016-10095: libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017690 http://bugzilla.suse.com/show_bug.cgi?id=1017690#c1 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #1 from Swamp Workflow Management <swamp(a)suse.de> --- bugbot adjusting priority -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017689] VUL-0: libtiff: assertion failure in readSeparateTilesIntoBuffer (tiffcp.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017689 http://bugzilla.suse.com/show_bug.cgi?id=1017689#c1 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #1 from Swamp Workflow Management <swamp(a)suse.de> --- bugbot adjusting priority -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017688] VUL-0: libtiff: NULL pointer dereference in TIFFReadRawData (tiffinfo.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017688 http://bugzilla.suse.com/show_bug.cgi?id=1017688#c1 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #1 from Swamp Workflow Management <swamp(a)suse.de> --- bugbot adjusting priority -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017682] VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017682 http://bugzilla.suse.com/show_bug.cgi?id=1017682#c2 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #2 from Swamp Workflow Management <swamp(a)suse.de> --- bugbot adjusting priority -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017683] /var/run should not be separate filesystem from /run
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017683 Arvin Schnell <aschnell(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aschnell(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1016402] X11:XOrg/Mesa: xf86-video-intel with DRI3
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.novell.com/show_bug.cgi?id=1016402 http://bugzilla.novell.com/show_bug.cgi?id=1016402#c1 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |flyhigh72(a)web.de Flags| |needinfo?(flyhigh72(a)web.de) --- Comment #1 from Stefan Dirsch <sndirsch(a)suse.com> --- Why do you want to disable DRI2> -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017195] Unnecessary dependency of snapper on MESA
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.novell.com/show_bug.cgi?id=1017195 http://bugzilla.novell.com/show_bug.cgi?id=1017195#c1 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|sndirsch(a)suse.com |bnc-team-screening(a)forge.pr | |ovo.novell.com --- Comment #1 from Stefan Dirsch <sndirsch(a)suse.com> --- Why me. The issue (dependancy) is in python, not in Mesa. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 622977] New: pstoedit crashes when called from inkscape
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.novell.com/show_bug.cgi?id=622977 http://bugzilla.novell.com/show_bug.cgi?id=622977#c0 Summary: pstoedit crashes when called from inkscape Classification: openSUSE Product: openSUSE 11.3 Version: Final Platform: All OS/Version: openSUSE 11.3 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: gerlach(a)mbi-berlin.de QAContact: qa(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.6) Gecko/20100626 SUSE/3.6.6-1.1 Firefox/3.6.6 pstoedit crashes when converting pdf to svg (used by inkscape textext) Reproducible: Always Steps to Reproduce: 1. pstoedit -f plot-svg file.pdf file.svg -dt -ssp -psarg -r9600x9600 (command used by inkscape) Actual Results: pstoedit: version 3.50 / DLL interface 108 (build Jul 5 2010 - release build - g++ 4.5.0 20100604 [gcc-4_5-branch revision 160292]) : Copyright (C) 1993 - 2009 Wolfgang Glunz Inconsistency detected by ld.so: dl-close.c: 731: _dl_close: Assertion `map->l_init_called' failed! -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 22

[Bug 1017696] New: Wrong command to install rpm file through yast2 from GUI
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017696 Bug ID: 1017696 Summary: Wrong command to install rpm file through yast2 from GUI Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: All OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: jakub.kuzniar(a)myswissmail.ch QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Wen user clicks rpm file on the Dolphin file manager and selects "Install/Remove Software", following command is invoked: xdg-su -c "/sbin/yast2 sw_single %F" yast2 opens if the package file name is regular one. In case if in rpm file name brackets are presents like adobeair.i386(1).rpm, yast2 does not start. Simple correction would be to add: \" xdg-su -c "/sbin/yast2 sw_single \"%F\"" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017693] New: VUL-0: libtiff: multiple heap-based buffer overflow
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017693 Bug ID: 1017693 Summary: VUL-0: libtiff: multiple heap-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/3 =========================================== Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. Some crafted images, through a fuzzing revealed multiple overflow. Since the number of the issues, I will post the relevant part of the stacktrace. Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3… Reproducer: https://github.com/asarubbo/poc/blob/master/00068-libtiff-heapoverflow-_tif… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==16440==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000e861 at pc 0x0000004531de bp 0x7ffd2aba5c30 sp 0x7ffd2aba53e0 READ of size 78490 at 0x62500000e861 thread T0 #1 0x7f280456d37b in _tiffWriteProc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:115:23 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3… Reproducer: https://github.com/asarubbo/poc/blob/master/00066-libtiff-heapoverflow-TIFF… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==14332==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63000000f4f0 at pc 0x7f95e90c11ad bp 0x7ffd74ba5ca0 sp 0x7ffd74ba5c98 READ of size 1 at 0x63000000f4f0 thread T0 #0 0x7f95e90c11ac in TIFFReverseBits /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_swab.c:289:27 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/1044b43637fa7f70fb19b93593777b78bd20… Reproducer: https://github.com/asarubbo/poc/blob/master/00071-libtiff-heapoverflow-_TIF… Relevant part of the stacktrace: #tiffcp -i $FILE /tmp/foo ==10398==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eef4 at pc 0x0000004bc235 bp 0x7fff3ebfa700 sp 0x7fff3ebf9eb0 READ of size 512 at 0x60200000eef4 thread T0 #1 0x7fcaf590cf0d in _TIFFmemcpy /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:340:2 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/9a72a69e035ee70ff5c41541c8c61cd97990… Reproducer: https://github.com/asarubbo/poc/blob/master/00074-libtiff-heapoverflow-TIFF… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==15106==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edd8 at pc 0x7f33918c5de3 bp 0x7ffc5abe6ba0 sp 0x7ffc5abe6b98 READ of size 8 at 0x60200000edd8 thread T0 #0 0x7f33918c5de2 in TIFFFillStrip /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_read.c:523:22 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0… Reproducer: https://github.com/asarubbo/poc/blob/master/00100-libtiff-heapoverflow-_TIF… Relevant part of the stacktrace: # tiffcrop -i $FILE /tmp/foo ==9181==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fd3b2e277f8 at pc 0x7fd3b7a762cc bp 0x7ffffd6e2550 sp 0x7ffffd6e2548 READ of size 1 at 0x7fd3b2e277f8 thread T0 #0 0x7fd3b7a762cb in _TIFFFax3fillruns /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_fax3.c:413:13 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0… Reproducer: https://github.com/asarubbo/poc/blob/master/00102-libtiff-heapoverflow-_TIF… Relevant part of the stacktrace: # tiffcrop -i $FILE /tmp/foo ==988==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001ccff at pc 0x0000004bc00c bp 0x7fff920da690 sp 0x7fff920d9e40 WRITE of size 1 at 0x62100001ccff thread T0 #1 0x7f49edd6af0d in _TIFFmemcpy /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:340:2 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/b4b41925115059b49f97432bda0613411df2… Reproducer: https://github.com/asarubbo/poc/blob/master/00067-libtiff-heapoverflow-tiff… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==7788==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edd3 at pc 0x0000004629ac bp 0x7ffe4adf8df0 sp 0x7ffe4adf85a0 READ of size 1 at 0x60200000edd3 thread T0 #1 0x50d6a5 in tiffcp /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:784:57 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: Upstream said that the previous changes, fixes this too. It needs to be bisected. Reproducer: https://github.com/asarubbo/poc/blob/master/00079-libtiff-heapoverflow-cpSe… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==25645==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f651cc3b800 at pc 0x00000051ef24 bp 0x7ffec0573a70 sp 0x7ffec0573a68 READ of size 16 at 0x7f651cc3b800 thread T0 #0 0x51ef23 in cpSeparateBufToContigBuf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:1209:14 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070… Reproducer: https://github.com/asarubbo/poc/blob/master/00082-libtiff-heap-overflow-cpS… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==20438==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fef2adde803 at pc 0x00000051befa bp 0x7ffd3ee26b50 sp 0x7ffd3ee26b48 WRITE of size 16 at 0x7fef2adde803 thread T0 #0 0x51bef9 in cpStripToTile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:1171:11 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: Upstream said that the previous changes, fixes this too. It needs to be bisected. Reproducer: https://github.com/asarubbo/poc/blob/master/00103-libtiff-heapoverflow-NeXT… Relevant part of the stacktrace: # tiffcrop -i $FILE /tmp/foo ==29649==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d00000a3fc at pc 0x0000004bc48c bp 0x7ffd6f23c680 sp 0x7ffd6f23be30 WRITE of size 2048 at 0x62d00000a3fc thread T0 #1 0x7fcac5ac0033 in NeXTDecode /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_next.c:64:9 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: Upstream said that the previous changes, fixes this too. It needs to be bisected. Reproducer: https://github.com/asarubbo/poc/blob/master/00102-libtiff-heapoverflow-_TIF… Relevant part of the stacktrace: # tiffcrop -i $FILE /tmp/foo ==23091==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eed2 at pc 0x0000004629dc bp 0x7fff8d1e2950 sp 0x7fff8d1e2100 READ of size 1 at 0x60200000eed2 thread T0 #1 0x53277f in writeCroppedImage /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcrop.c:7940:23 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/5ed9fea523316c2f5cec4d393e4d5d671c2d… Reproducer: https://github.com/asarubbo/poc/blob/master/00108-libtiff-heapoverflow-PSDa… Relevant part of the stacktrace: # tiff2ps $FILE ==32416==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ee91 at pc 0x00000051ea78 bp 0x7ffd76b73dd0 sp 0x7ffd76b73dc8 READ of size 1 at 0x60200000ee91 thread T0 #0 0x51ea77 in PSDataBW /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2ps.c:2703:21 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/5ed9fea523316c2f5cec4d393e4d5d671c2d… Reproducer: https://github.com/asarubbo/poc/blob/master/00107-libtiff-heapoverflow-PSDa… Relevant part of the stacktrace: # tiff2ps $FILE ==31384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ee54 at pc 0x000000518b75 bp 0x7fff437bfdb0 sp 0x7fff437bfda8 READ of size 1 at 0x60200000ee54 thread T0 #0 0x518b74 in PSDataColorContig /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2ps.c:2470:2 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/bd9d7670d0224412b3bd146e221658211ece… Reproducer: https://github.com/asarubbo/poc/blob/master/00101-libtiff-heapoverflow-comb… Relevant part of the stacktrace: # tiffcrop -i $FILE /tmp/foo ==8016==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eef1 at pc 0x000000530805 bp 0x7ffeb0d41770 sp 0x7ffeb0d41768 READ of size 1 at 0x60200000eef1 thread T0 #0 0x530804 in combineSeparateSamples16bits /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcrop.c:3913:20 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/c7153361a4041260719b340f73f2f76b0969… Reproducer: https://github.com/asarubbo/poc/blob/master/00112-libtiff-heapoverflow-_TIF… Relevant part of the stacktrace: # tiff2pdf $FILE -o foo ==31315==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ea11 at pc 0x0000004bc10c bp 0x7fffd59abc40 sp 0x7fffd59ab3f0 WRITE of size 2 at 0x60200000ea11 thread T0 #1 0x7fd49c1adf0d in _TIFFmemcpy /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:340:2 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00109-libtiff-heapoverflow-putc… Relevant part of the stacktrace: # tiff2rgba $FILE /tmp/foo ==20699==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000ed12 at pc 0x7f49ab2c134c bp 0x7ffc7e4eda30 sp 0x7ffc7e4eda28 READ of size 1 at 0x62500000ed12 thread T0 #0 0x7f49ab2c134b in putcontig8bitYCbCr44tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_getimage.c:1885:28 Credit: These bugs were discovered by Agostino Sarubbo of Gentoo. Timeline: 2016-11-20: started to post the issues to upstream 2017-01-01: blog post about the issue Note: These bugs were found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-… -- Agostino Sarubbo Gentoo Linux Developer =========================================== https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 1