January 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1017690] New: VUL-0: libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017690 Bug ID: 1017690 Summary: VUL-0: libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/6 ============================================= Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a stack buffer overflow. The complete ASan output: # tiffsplit $FILE TIFFReadDirectory: Warning, Unknown field with tag 317 (0x13d) encountered. ================================================================= ==10362==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3824f00090 at pc 0x7f3829624fbb bp 0x7fffe0eb1da0 sp 0x7fffe0eb1d98 WRITE of size 4 at 0x7f3824f00090 thread T0 #0 0x7f3829624fba in _TIFFVGetField /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_dir.c:1077:29 #1 0x7f382960f202 in TIFFVGetField /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_dir.c:1198:6 #2 0x7f382960f202 in TIFFGetField /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_dir.c:1182 #3 0x50a719 in tiffcp /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffsplit.c:183:2 #4 0x50a719 in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffsplit.c:89 #5 0x7f382871561f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 #6 0x419a78 in _init (/usr/bin/tiffsplit+0x419a78) Address 0x7f3824f00090 is located in stack of thread T0 at offset 144 in frame #0 0x5099cf in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffsplit.c:59 This frame has 18 object(s): [32, 40) 'bytecounts.i263.i' [64, 72) 'bytecounts.i.i' [96, 98) 'bitspersample.i' [112, 114) 'samplesperpixel.i' [128, 130) 'compression.i' [144, 146) 'shortv.i' 0x0fe7849d8010: 02 f2[02]f2 00 f2 f2 f2 04 f2 04 f2 04 f2 00 f2 0x0fe7849d8020: f2 f2 04 f2 04 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 0x0fe7849d8030: f2 f2 00 f2 f2 f2 02 f3 00 00 00 00 00 00 00 00 0x0fe7849d8040: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 0x0fe7849d8050: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 0x0fe7849d8060: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10362==ABORTING Affected version: 4.0.7 Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00104-libtiff-stackoverflow-_TI… Timeline: 2016-12-04: bug discovered and reported to upstream 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow… -- Agostino Sarubbo Gentoo Linux Developer ============================================= https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1017694] New: VUL-0: libtiff: multiple divide-by-zero
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017694 Bug ID: 1017694 Summary: VUL-0: libtiff: multiple divide-by-zero Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/2 =========================================== Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. Some crafted images, through a fuzzing revealed multiple division by zero. Since the number of the issues, I will post the relevant part of the stacktrace. Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/438274f938e046d33cb0e1230b41da32ffe2… Reproducer: https://github.com/asarubbo/poc/blob/master/00064-libtiff-fpe-TIFFReadEncod… Relevant part of the stacktrace: # tiffcp $FILE /tmp/foo ==12079==ERROR: AddressSanitizer: FPE on unknown address 0x7fd319436251 (pc 0x7fd319436251 bp 0x7fff851e3d80 sp 0x7fff851e3d30 T0) #0 0x7fd319436250 in TIFFReadEncodedStrip /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_read.c:351:22 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/43bc256d8ae44b92d2734a3c5bc73957a4d7… Reproducer: https://github.com/asarubbo/poc/blob/master/00083-libtiff-fpe-OJPEGDecodeRaw Relevant part of the stacktrace: # tiffmedia $FILE /tmp/foo ==28106==ERROR: AddressSanitizer: FPE on unknown address 0x7faeae7f744e (pc 0x7faeae7f744e bp 0x7ffceab45e40 sp 0x7ffceab45ce0 T0) #0 0x7faeae7f744d in OJPEGDecodeRaw /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_ojpeg.c:816:8 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/d3c5426395dc53e3345712ac7246c29db9fe… Reproducer: https://github.com/asarubbo/poc/blob/master/00099-libtiff-fpe-readSeparateS… Relevant part of the stacktrace: # tiffcrop $FILE /tmp/foo ==19098==ERROR: AddressSanitizer: FPE on unknown address 0x000000523acf (pc 0x000000523acf bp 0x7ffcb22ada30 sp 0x7ffcb22ad780 T0) #0 0x523ace in readSeparateStripsIntoBuffer /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcrop.c:4841:36 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/a87eb62049f446204ed62c939f965eb76bd9… Reproducer: https://github.com/asarubbo/poc/blob/master/00065-libtiff-fpe-readSeparateT… Relevant part of the stacktrace: # tiffcp $FILE /tmp/foo ==13262==ERROR: AddressSanitizer: FPE on unknown address 0x00000051c43b (pc 0x00000051c43b bp 0x7ffdc8d81d70 sp 0x7ffdc8d81b20 T0) #0 0x51c43a in readSeparateTilesIntoBuffer /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:1434:9 ############################################### Affected version / Tested on: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/296803e79542f5523be1009d64574507b9ac… Reproducer: https://github.com/asarubbo/poc/blob/master/00073-libtiff-fpe-writeBufferTo… Relevant part of the stacktrace: # tiffcp -i $FILE /tmp/foo ==3614==ERROR: AddressSanitizer: FPE on unknown address 0x00000051650a (pc 0x00000051650a bp 0x7fff41587d30 sp 0x7fff41587b00 T0) #0 0x516509 in writeBufferToSeparateTiles /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:1591:13 Credit: These bugs were discovered by Agostino Sarubbo of Gentoo. Timeline: 2016-11-20: started to post the issues to upstream 2017-01-01: blog post about the issue Note: These bugs were found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-divide-by-zero -- Agostino Sarubbo Gentoo Linux Developer =========================================== https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017692] New: VUL-0: libtiff: invalid memory READ in t2p_writeproc (tiff2pdf.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017692 Bug ID: 1017692 Summary: VUL-0: libtiff: invalid memory READ in t2p_writeproc (tiff2pdf.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/4 =========================================== Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed an invalid memory read. The complete ASan output: # tiff2pdf $FILE -o foo TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. 111.crashes: Warning, Nonstandard tile length 3, convert file. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFFetchNormalTag: Warning, ASCII value for tag "Software" contains null byte in value; value incorrectly truncated during reading due to implementation limitations. TIFFAdvanceDirectory: Error fetching directory count. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. 111.crashes: Warning, Nonstandard tile length 3, convert file. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFFetchNormalTag: Warning, ASCII value for tag "Software" contains null byte in value; value incorrectly truncated during reading due to implementation limitations. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. 111.crashes: Warning, Nonstandard tile length 3, convert file. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFFetchNormalTag: Warning, ASCII value for tag "Software" contains null byte in value; value incorrectly truncated during reading due to implementation limitations. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. 111.crashes: Warning, Nonstandard tile length 3, convert file. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFFetchNormalTag: Warning, ASCII value for tag "Software" contains null byte in value; value incorrectly truncated during reading due to implementation limitations. tiff2pdf: Warning, RGB image 111.crashes has 4 samples per pixel, assuming RGBA. TIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 0; got 0 bytes, expected 23297. TIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 1; got 0 bytes, expected 513. TIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 2; got 512 bytes, expected 65285. TIFFReadRawTile: Read error at row 4294967295, col 4294967295, tile 3; got 512 bytes, expected 1535. ASAN:DEADLYSIGNAL ================================================================= ==19864==ERROR: AddressSanitizer: SEGV on unknown address 0x61b000020000 (pc 0x7fc86d4a320b bp 0x000000000efc sp 0x7fff06650bf8 T0) ==19864==The signal is caused by a READ memory access. #0 0x7fc86d4a320a /var/tmp/portage/sys-libs/glibc-2.22- r4/work/glibc-2.22/string/../sysdeps/x86_64/memcpy.S:270 #1 0x7fc86d491f79 in _IO_file_xsputn /var/tmp/portage/sys-libs/glibc-2.22- r4/work/glibc-2.22/libio/fileops.c:1319 #2 0x7fc86d487828 in fwrite /var/tmp/portage/sys-libs/glibc-2.22- r4/work/glibc-2.22/libio/iofwrite.c:43 #3 0x50cdff in t2p_writeproc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:405:21 #4 0x52baea in t2pWriteFile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:379:10 #5 0x52baea in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:2924 #6 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #7 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #8 0x7fc86d43e61f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 #9 0x41a298 in _init (/usr/bin/tiff2pdf+0x41a298) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/sys-libs/glibc-2.22- r4/work/glibc-2.22/string/../sysdeps/x86_64/memcpy.S:270 ==19864==ABORTING Affected version: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/891b1b908eb92a0e91e9012a8d32ade7088b… Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00111-libtiff-invalidread-t2p_w… Timeline: 2016-12-20: bug discovered and reported to upstream 2016-12-20: upstream released a patch 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-invalid-memory-read-in-t2p_… -- Agostino Sarubbo Gentoo Linux Developer =========================================== https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017691] New: VUL-0: libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017691 Bug ID: 1017691 Summary: VUL-0: libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/5 ============================================ Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a memcpy-param-overlap. The complete ASan output: # tiff2pdf $FILE -o foo TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFAdvanceDirectory: Error fetching directory count. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. 1006.crashes: Warning, Nonstandard tile width 769, convert file. TIFFReadDirectory: Warning, Unknown field with tag 7710 (0x1e1e) encountered. TIFFFetchNormalTag: Warning, Incorrect count for "FillOrder"; tag ignored. TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored. Fax3Decode2D: Warning, Premature EOL at line 0 of tile 0 (got 768, expected 769). Fax3Decode2D: Warning, Premature EOL at line 1 of tile 0 (got 35, expected 769). Fax3Decode2D: Warning, Premature EOL at line 2 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 3 of tile 0 (got 0, expected 769). Fax3Decode2D: Uncompressed data (not supported) at line 4 of tile 0 (x 0). Fax3Decode2D: Warning, Premature EOL at line 4 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 5 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 7 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 8 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Premature EOL at line 9 of tile 0 (got 0, expected 769). Fax3Decode2D: Warning, Line length mismatch at line 10 of tile 0 (got 1792, expected 769). Fax3Decode2D: Warning, Premature EOL at line 11 of tile 0 (got 0, expected 769). ================================================================= ==29687==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f2dcce0b85d,0x7f2dcce0b8ba) and [0x7f2dcce0b861, 0x7f2dcce0b8be) overlap #0 0x4bbee1 in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 #1 0x7f2dccb87f0d in _TIFFmemcpy /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:340:2 #2 0x52ac36 in t2p_tile_collapse_left /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:3596:3 #3 0x52ac36 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:3073 #4 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #5 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #6 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 #7 0x41a298 in _init (/usr/bin/tiff2pdf+0x41a298) 0x7f2dcce0b85d is located 93 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00) allocated by thread T0 here: #0 0x4d3058 in malloc /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7f2dccb87d7e in _TIFFmalloc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:316:10 #2 0x5294e8 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:2933:29 #3 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #4 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #5 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 0x7f2dcce0b861 is located 97 bytes inside of 968448-byte region [0x7f2dcce0b800,0x7f2dccef7f00) allocated by thread T0 here: #0 0x4d3058 in malloc /tmp/portage/sys-devel/llvm-3.9.0- r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7f2dccb87d7e in _TIFFmalloc /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/libtiff/tif_unix.c:316:10 #2 0x5294e8 in t2p_readwrite_pdf_image_tile /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:2933:29 #3 0x50f1dc in t2p_write_pdf /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:5526:16 #4 0x50bfee in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiff2pdf.c:808:2 #5 0x7f2dcbb4361f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 SUMMARY: AddressSanitizer: memcpy-param-overlap /tmp/portage/sys- devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler- rt/lib/asan/asan_interceptors.cc:413 in __asan_memcpy ==29687==ABORTING Affected version: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/ad2fccbf5c23da10c5859114a6018a37fdd0… Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00110-libtiff-memcpy-param-over… Timeline: 2016-12-20: bug discovered and reported to upstream 2016-12-20: upstream released a patch 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-memcpy-param-overlap-in-_ti… -- Agostino Sarubbo Gentoo Linux Developer ============================================ https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017689] New: VUL-0: ibtiff: assertion failure in readSeparateTilesIntoBuffer (tiffcp.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017689 Bug ID: 1017689 Summary: VUL-0: ibtiff: assertion failure in readSeparateTilesIntoBuffer (tiffcp.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/7 ============================================ Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed an assertion failure. The complete output: # tiffcp -i $FILE /tmp/foo tiffcp: /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffcp.c:1390: int readSeparateTilesIntoBuffer(TIFF *, uint8 *, uint32, uint32, tsample_t): Assertion `bps % 8 == 0' failed. Affected version: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/7ff9652da2eec4c65279dcbc7e55c0418e87… Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00072-libtiff-assert-readSepara… Timeline: 2016-11-23: bug discovered and reported to upstream 2016-12-03: upstream released a patch 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-assertion-failure-in-readse… -- Agostino Sarubbo Gentoo Linux Developer ============================================ https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1017688] New: VUL-0: libtiff: NULL pointer dereference in TIFFReadRawData (tiffinfo.c)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017688 Bug ID: 1017688 Summary: VUL-0: libtiff: NULL pointer dereference in TIFFReadRawData (tiffinfo.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/8 ============================================= Description: Libtiff is a software that provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. A crafted tiff file revealed a NULL pointer access. The complete ASan output: # tiffinfo -Dijr $FILE TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order. TIFFReadDirectory: Warning, Unknown field with tag 384 (0x180) encountered. TIFFReadDirectory: Warning, Unknown field with tag 1093 (0x445) encountered. TIFFReadDirectory: Warning, Unknown field with tag 2 (0x2) encountered. TIFFFetchNormalTag: Warning, ASCII value for tag "DocumentName" contains null byte in value; value incorrectly truncated during reading due to implementation limitations. TIFFFetchNormalTag: Warning, Incorrect count for "JpegProc"; tag ignored. TIFFReadDirectory: Warning, Photometric tag value assumed incorrect, assuming data is YCbCr instead of RGB. TIFFReadDirectory: Warning, SamplesPerPixel tag is missing, applying correct SamplesPerPixel value of 3. _TIFFVSetField: Warning, SamplesPerPixel tag value is changing, but SMinSampleValue tag was read with a different value. Cancelling it. ASAN:DEADLYSIGNAL ================================================================= ==15897==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000050d8ad bp 0x7ffc4a3eaf90 sp 0x7ffc4a3eaec0 T0) ==15897==The signal is caused by a READ memory access. ==15897==Hint: address points to the zero page. #0 0x50d8ac in TIFFReadRawData /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffinfo.c:421:29 #1 0x50b2de in tiffinfo /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffinfo.c:473:4 #2 0x50a999 in main /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffinfo.c:152:6 #3 0x7f6258f0961f in __libc_start_main /var/tmp/portage/sys- libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289 #4 0x419f38 in _init (/usr/bin/tiffinfo+0x419f38) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /tmp/portage/media- libs/tiff-4.0.7/work/tiff-4.0.7/tools/tiffinfo.c:421:29 in TIFFReadRawData ==15897==ABORTING TIFF Directory at offset 0xc (12) Image Width: 128 Image Length: 1 Bits/Sample: 32189 Compression Scheme: Old-style JPEG Photometric Interpretation: YCbCr YCbCr Subsampling: 2, 2 Samples/Pixel: 3 Rows/Strip: 2048 Planar Configuration: single image plane DocumentName: Tag 384: 16779264 Affected version: 4.0.7 Fixed version: N/A Commit fix: https://github.com/vadz/libtiff/commit/c2f931bb558b9db41cb3516a6df3aa600fd8… Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00056-libtiff-nullptr-TIFFReadR… Timeline: 2016-11-22: bug discovered and reported to upstream 2016-12-03: upstream released a patch 2017-01-01: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/01/01/libtiff-null-pointer-dereference-in… -- Agostino Sarubbo Gentoo Linux Developer ============================================= https://software.opensuse.org/package/libtiff5 TW: 4.0.7 42.2: 4.0.6 42.1: 4.0.6 13.2: 4.0.7 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1015156] New: After Suspend, no password is being asked for
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1015156 Bug ID: 1015156 Summary: After Suspend, no password is being asked for Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: yanestra(a)arcor.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When using "Power / Session" -> Suspend, everything works fine, except that there is no password being asked for, so everyone can take advantage of the situation after waking up the system. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1017537] New: KDE5: drag file from webbrowser to dolphin gives future date 2106-02-07 (regression)
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017537 Bug ID: 1017537 Summary: KDE5: drag file from webbrowser to dolphin gives future date 2106-02-07 (regression) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: tuxuser(a)quantentunnel.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Drag a file from a webbrowser (firefox, konqueror, chromium) to dolphin downloads that file. Problem: The file should get actual time/date as creation/modif date/time. But it gets a timestamp in the far future: 2106-02-07. There was no problem downloading files per dragging to dolphin with kde4 / openSuse 13.2. The same problem is still around with the tumbleweed snapshot 2016-12-26. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1006601] New: Latest Tumbleweed update Blueman now asking for Polkit authentication twice
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1006601 Bug ID: 1006601 Summary: Latest Tumbleweed update Blueman now asking for Polkit authentication twice Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: sb56637(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hello, with the Cinnamon desktop (and probably others) the Blueman applet now causes two ugly authentication prompts immediately after login. It is missing PolKit authentication for: org.blueman.network.setup and org.blueman.rfkill.setstate . -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1017137] New: scaling, => bad drawing of text and image
by bugzilla_noreply＠novell.com 01 Jan '17

01 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017137 Bug ID: 1017137 Summary: scaling, => bad drawing of text and image Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: epistemepromeneur(a)free.fr QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 707777 --> http://bugzilla.opensuse.org/attachment.cgi?id=707777&action=edit crenalated or slimy text and image in kde settings i set scaling to 1.2 then i restart pc then the kde session template is crenelated for some kde windows text and draw are crenelated or slimy see the attachment -- You are receiving this mail because: You are on the CC list for the bug.

1 1