Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: <filtered@awaresystems.be>
Received: from mx1.public.one.com ([10.246.18.21])
	by mail6.local.one.com (Dovecot) with LMTP id yRkwOL5D5VdFTwAAsyOMew
	for <filtered@awaresystems.be>; Fri, 23 Sep 2016 15:16:27 +0000
X-HalOne-ID: b1b23aaf-81a0-11e6-b85f-b82a72d859f1
Received: from mail-qk0-f182.google.com (unknown [209.85.220.182])
	by mx1.public.one.com (Halon Mail Gateway) with ESMTPS
	for <filtered@awaresystems.be>; Fri, 23 Sep 2016 15:16:25 +0000 (UTC)
Received: by mail-qk0-f182.google.com with SMTP id g67so48645763qkd.0
        for <filtered@awaresystems.be>; Fri, 23 Sep 2016 08:16:25 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:x-gm-message-state:delivered-to
         :date:from:to:in-reply-to:message-id:references:user-agent
         :mime-version:cc:subject:precedence:list-id:list-unsubscribe
         :list-archive:list-post:list-help:list-subscribe:sender:errors-to;
        bh=nm5e/aOa7KYQJfbw8oyWKdnJSSoGjG+fMC953D4x7Ec=;
        b=RNF4Zrxm4klIDnhq2W3w5ZV5vXBAMx6k0tl6BAnzweKv5dYPdVB7Ix7q84CXpEDF+3
         ctZ4/3pwq+6SgZS0FXjVH+9bE7xbtEhQk3uDz2QUSLChpqedgG8x+fktIudVNwngqQSZ
         G3Q2jpE8tjcAIhedsr8FLUwzVz1i96aS5JDtlD+SmfFr3tsgQH0y4r32W4V8oFTXsjTN
         vRqStJFI/eWYmOnNsu8GMbIl/szvS470hD6OvNT2qNu7ppcMVv/FH6kxkH6M+OMkYgVi
         /Cr3XtfaH4o34zf4u+MXH4n6q/JBXons1ruMSLVvKR0aBY6Th06I7xbMjmLA6x9bIr/+
         Mflw==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
X-Gm-Message-State: AA6/9RmyN9zC6jIKHhzSDOoOrR3M17oJx+SUZnIfmLF6aXVuoOwlR4ya4xfbpt0e0Nn4aUhi91v//GvcqJGZosPmvwpmjwI=
X-Received: by 10.55.159.77 with SMTP id i74mr7923412qke.60.1474643784144;
        Fri, 23 Sep 2016 08:16:24 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.55.161.4 with SMTP id k4csp592667qke;
        Fri, 23 Sep 2016 08:16:23 -0700 (PDT)
X-Received: by 10.194.156.226 with SMTP id wh2mr8746424wjb.150.1474643783058;
        Fri, 23 Sep 2016 08:16:23 -0700 (PDT)
Return-Path: <tiff-bounces@lists.maptools.org>
Received: from lists.maptools.org (ks365428.kimsufi.com. [94.23.4.142])
        by mx.google.com with ESMTP id n7si4282898wmf.0.2016.09.23.08.16.21;
        Fri, 23 Sep 2016 08:16:23 -0700 (PDT)
Received-SPF: neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=94.23.4.142;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 4EF9435C0DD;
	Fri, 23 Sep 2016 10:15:26 -0500 (EST)
Received: from smtp.simplesystems.org (smtp.simplesystems.org [65.66.246.90])
	by lists.maptools.org (Postfix) with ESMTPS id C9D2335C092
	for <tiff@lists.maptools.org>; Fri, 23 Sep 2016 10:15:13 -0500 (EST)
Received: from freddy.simplesystems.org (freddy.simplesystems.org
	[65.66.246.65])
	by smtp.simplesystems.org (8.14.4+Sun/8.14.4) with ESMTP id
	u8NFFAcN010605; Fri, 23 Sep 2016 10:15:10 -0500 (CDT)
Date: Fri, 23 Sep 2016 10:15:10 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
X-X-Sender: bfriesen@freddy.simplesystems.org
To: "Yves Younan (yvyounan)" <yvyounan@cisco.com>
In-Reply-To: <43339E27-2FDC-4098-8C06-5A16C1D1C8FC@cisco.com>
Message-ID: <alpine.GSO.2.20.1609230958550.5577@freddy.simplesystems.org>
References: <43339E27-2FDC-4098-8C06-5A16C1D1C8FC@cisco.com>
User-Agent: Alpine 2.20 (GSO 67 2015-01-07)
MIME-Version: 1.0
Content-Type: multipart/mixed;
	BOUNDARY="-559023410-1378225296-1474643710=:5577"
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
	(smtp.simplesystems.org [65.66.246.90]);
	Fri, 23 Sep 2016 10:15:10 -0500 (CDT)
Cc: "vulndev\(mailer list\)" <vulndev@cisco.com>,
	"tiff@lists.maptools.org" <tiff@lists.maptools.org>
Subject: Re: [Tiff] LibTIFF vulnerabilities
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

---559023410-1378225296-1474643710=:5577
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8BIT

On Fri, 23 Sep 2016, Yves Younan (yvyounan) wrote:

> Hi,
>
> Cisco Talos has identified a couple of vulnerabilities in LibTIFF. 
> Our vulnerability coordinator, Regina Wilson, has been trying to 
> reach a maintainer of the library for a while but has been unable to 
> get a response. She’s emailed both Frank Warmerdam 
> (warmerdam@pobox.com) and tiff@remotesensing.org multiple times with 
> details of the vulnerabilities but we’ve been unable to get a 
> response.

This is the first I have heard of it.  The remotesensing.org domain 
was lost a couple of weeks ago and we have not heard from Frank 
Warmerdam in some time.

In the mean time I put the current libtiff web site content up at 
"http://www.simplesystems.org/libtiff/" and it was already mirrored at 
"http://libtiff.maptools.org/".

I will update the libtiff main page (wherever it is actively mirrored) 
to reflect current realities.

> Per our disclosure policy, which states that vulnerabilities are 
> eligible to be released 60 days after vendor notification 
> (http://www.cisco.com/web/about/security/psirt/vendor_vulnerability_policy.html), 
> the first of these vulnerabilities is eligible to be publicly 
> disclosed Sunday, September 25th. However, if someone who is able to 
> commit code is willing to contact us immediately to get these 
> vulnerabilities fixed, we’re willing to delay public disclosure.

Recent libtiff maintenance has primarily been done by Even Rouault and 
myself.  We are able to commit code.  Please send your vulnerability 
report to me and I will make sure that Even gets a copy.

It is ideal if the reporter applies for a CVE for any vulnerability so 
that the problem may be tracked.

While a fix may be commited to libtiff CVS expediently, this does not 
necessarily result in an expedient fix to the millions of copies of 
libtiff which are already in use.

Bob
-- 
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
---559023410-1378225296-1474643710=:5577
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
---559023410-1378225296-1474643710=:5577--
