Return-Path: <tiff-bounces@lists.maptools.org>
X-Original-To: info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-h.b-one.net (mx-h.one.com [91.198.169.55])
	by mail9.b-one.net (Postfix) with ESMTP id C52FD40014C
	for <info@awaresystems.be>; Mon,  6 Dec 2010 19:53:17 +0100 (CET)
Received: by mx-h.b-one.net (Postfix, from userid 106)
	id BBC76121CF; Mon,  6 Dec 2010 19:53:17 +0100 (CET)
X-Virus-Scanned: by one.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level: 
X-Spam-Status: No, score=0 tagged_above=0 required=4 tests=[none]
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from lists.maptools.org (lists.maptools.org [65.39.174.144]) by
 mx-h.b-one.net (Postfix) with ESMTP id DE0DABD for <info@awaresystems.be>;
 Mon,  6 Dec 2010 19:53:16 +0100 (CET)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by
 lists.maptools.org (Postfix) with ESMTP id 2472D1D0E5293; Mon,  6 Dec 2010
 13:50:38 -0500 (EST)
Received: from mail.howardsilvan.com (fangorn.howardsilvan.com
 [216.235.106.115]) by lists.maptools.org (Postfix) with ESMTPS id
 C52F51D0E410A for <tiff@lists.maptools.org>; Mon,  6 Dec 2010 13:45:05 -0500
 (EST)
Received: from fangorn.howardsilvan.com (localhost [127.0.0.1]) by
 mail.howardsilvan.com (Postfix) with ESMTP id 1D669C420DC; Mon,  6 Dec 2010
 10:44:57 -0800 (PST)
Received: from bilbo.x101.com ([64.146.212.27] helo=bilbo.x101.com) with
 IPv4:25 by fangorn.howardsilvan.com; 6 Dec 2010 10:44:56 -0800
Message-ID: <4CFD2F2B.5050602@howardsilvan.com>
Date: Mon, 06 Dec 2010 10:44:59 -0800
From: Lee Howard <faxguy@howardsilvan.com>
User-Agent: Thunderbird 2.0.0.19 (X11/20090105)
MIME-Version: 1.0
To: imipak <imipak@gmail.com>
References: <AANLkTik8dnMvkDGGPpeiDVsDVzxYsW6Pq6Fq0DkMXu8K@mail.gmail.com>
In-Reply-To: <AANLkTik8dnMvkDGGPpeiDVsDVzxYsW6Pq6Fq0DkMXu8K@mail.gmail.com>
Cc: tiff@lists.maptools.org
Subject: Re: [Tiff] Security vulnerability CVE-2010-3847
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

imipak wrote:
> I notice that Mandriva and SuSE have released updates for their
> libtiff packages to fix for CVE-2010-3087, but there doesn't seem to
> be any sign of it in the changelog for 3.9.4 (or, indeed, earlier
> releases.)
>
> CVE:
>    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3087
>
> Mandriva:
>    http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:190
>
> SuSE:
>    http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
>
>
> Is there any ETA for a fix on the main source tree?

I've just now committed the in-line patch found on...

http://bugzilla.maptools.org/show_bug.cgi?id=2228

... I'm not sure if that small change resolves CVE-2010-3087.  The 
various distros are using Tom Lane's patch on...

http://bugzilla.maptools.org/show_bug.cgi?id=2140

... as a resolution to CVE-2010-3087.

You can see on the bug report that Frank seemed to object to Tom's 
proposal on Bug 2140, so I think for the moment we're stuck there 
needing some further response from Frank on this.  (Frank?)

Thanks,

Lee.

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
