Bug 6833 - libtiff new security issue CVE-2012-3401
: libtiff new security issue CVE-2012-3401
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 2
: i586 Linux
: Normal Severity: normal
: ---
Assigned To: QA Team
:
: http://lwn.net/Vulnerabilities/507521/
: MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32...
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2012-07-20 00:16 CEST by David Walser
Modified: 2012-07-24 13:50 CEST (History)
4 users (show)

See Also:
Source RPM: libtiff-4.0.1-2.1.mga2.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2012-07-20 00:16:51 CEST
Ubuntu has issued an advisory today (July 19):
http://www.ubuntu.com/usn/usn-1511-1/

Patched package uploaded for Mageia 1, Mageia 2, and Cauldron.

More info about this is available in RH bugzilla (see the Ubuntu CVE link).

Advisory:
========================

Updated libtiff packages fix security vulnerability:

Huzaifa Sidhpurwala discovered that the tiff2pdf utility incorrectly
handled certain malformed TIFF images. If a user or automated system were
tricked into opening a specially crafted TIFF image, a remote attacker
could crash the application, leading to a denial of service, or possibly
execute arbitrary code with user privileges (CVE-2012-3401).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3401
http://www.ubuntu.com/usn/usn-1511-1/
========================

Updated packages in core/updates_testing:
========================
libtiff-progs-3.9.5-1.5.mga1
libtiff3-3.9.5-1.5.mga1
libtiff-devel-3.9.5-1.5.mga1
libtiff-static-devel-3.9.5-1.5.mga1
libtiff-progs-4.0.1-2.2.mga2
libtiff5-4.0.1-2.2.mga2
libtiff-devel-4.0.1-2.2.mga2
libtiff-static-devel-4.0.1-2.2.mga2

from SRPMS:
libtiff-3.9.5-1.5.mga1.src.rpm
libtiff-4.0.1-2.2.mga2.src.rpm
Comment 1 Samuel Verschelde 2012-07-21 13:07:19 CEST
I haven't found an exploit for this security vulnerability, so we are bound just to test that the update candidate still works.
Comment 2 Samuel Verschelde 2012-07-21 13:21:15 CEST
I created a testing procedure for libtiff at https://wiki.mageia.org/en/QA_procedure:Libtiff based on testing reports from previous updates.
Feel free to improve it.
Comment 3 Samuel Verschelde 2012-07-21 13:38:58 CEST
Testing complete for Mageia 1 32 bits
Comment 4 Dave Hodgins 2012-07-21 20:35:10 CEST
I'll test Mageia 2 i586 shortly.
Comment 5 Samuel Verschelde 2012-07-21 20:43:24 CEST
Testing complete for Mageia 1 64 bits
Comment 6 Dave Hodgins 2012-07-21 20:52:39 CEST
Testing complete Mageia 2 i586.
Comment 7 Samuel Verschelde 2012-07-23 16:54:04 CEST
Testing complete Mageia 2 x86_64.

Update validated. See comment #0 for advisory and SRPMs. No linking needed. Thanks!
Comment 8 Thomas Backlund 2012-07-24 13:50:52 CEST
Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0181

Note You need to log in before you can comment on or make changes to this bug.