Bug 6833

Summary:	libtiff new security issue CVE-2012-3401
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, stormi-mageia, sysadmin-bugs, tmb
Version:	2	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/507521/
Whiteboard:	MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32-OK MGA2-64-OK
Source RPM:	libtiff-4.0.1-2.1.mga2.src.rpm	CVE:
Status comment:

Description David Walser 2012-07-20 00:16:51 CEST

Ubuntu has issued an advisory today (July 19):
http://www.ubuntu.com/usn/usn-1511-1/

Patched package uploaded for Mageia 1, Mageia 2, and Cauldron.

More info about this is available in RH bugzilla (see the Ubuntu CVE link).

Advisory:
========================

Updated libtiff packages fix security vulnerability:

Huzaifa Sidhpurwala discovered that the tiff2pdf utility incorrectly
handled certain malformed TIFF images. If a user or automated system were
tricked into opening a specially crafted TIFF image, a remote attacker
could crash the application, leading to a denial of service, or possibly
execute arbitrary code with user privileges (CVE-2012-3401).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3401
http://www.ubuntu.com/usn/usn-1511-1/
========================

Updated packages in core/updates_testing:
========================
libtiff-progs-3.9.5-1.5.mga1
libtiff3-3.9.5-1.5.mga1
libtiff-devel-3.9.5-1.5.mga1
libtiff-static-devel-3.9.5-1.5.mga1
libtiff-progs-4.0.1-2.2.mga2
libtiff5-4.0.1-2.2.mga2
libtiff-devel-4.0.1-2.2.mga2
libtiff-static-devel-4.0.1-2.2.mga2

from SRPMS:
libtiff-3.9.5-1.5.mga1.src.rpm
libtiff-4.0.1-2.2.mga2.src.rpm

David Walser 2012-07-20 00:16:57 CEST

Whiteboard: (none) => MGA1TOO

Comment 1 Samuel Verschelde 2012-07-21 13:07:19 CEST

I haven't found an exploit for this security vulnerability, so we are bound just to test that the update candidate still works.

CC: (none) => stormi

Comment 2 Samuel Verschelde 2012-07-21 13:21:15 CEST

I created a testing procedure for libtiff at https://wiki.mageia.org/en/QA_procedure:Libtiff based on testing reports from previous updates.
Feel free to improve it.

Comment 3 Samuel Verschelde 2012-07-21 13:38:58 CEST

Testing complete for Mageia 1 32 bits

Whiteboard: MGA1TOO => MGA1TOO MGA1-32-OK

Comment 4 Dave Hodgins 2012-07-21 20:35:10 CEST

I'll test Mageia 2 i586 shortly.

CC: (none) => davidwhodgins

Comment 5 Samuel Verschelde 2012-07-21 20:43:24 CEST

Testing complete for Mageia 1 64 bits

Whiteboard: MGA1TOO MGA1-32-OK => MGA1TOO MGA1-32-OK MGA1-64-OK

Comment 6 Dave Hodgins 2012-07-21 20:52:39 CEST

Testing complete Mageia 2 i586.

Whiteboard: MGA1TOO MGA1-32-OK MGA1-64-OK => MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32-OK

Comment 7 Samuel Verschelde 2012-07-23 16:54:04 CEST

Testing complete Mageia 2 x86_64.

Update validated. See comment #0 for advisory and SRPMs. No linking needed. Thanks!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Whiteboard: MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32-OK => MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32-OK MGA2-64-OK

Comment 8 Thomas Backlund 2012-07-24 13:50:52 CEST

Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0181

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED