Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-q.one.com (mx-q.one.com [91.198.169.248])
	by mail6.local.one.com (Postfix) with ESMTP id 9488D3002FED74
	for <filtered@awaresystems.be>; Thu,  2 Oct 2014 14:32:16 +0000 (UTC)
X-Virus-Scanned: by one.com
Received-SPF: pass (mx-q: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.215.43 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-la0-f43.google.com (mail-la0-f43.google.com [209.85.215.43])
	by mx-q.one.com (Postfix) with ESMTP id 4EBB952092E
	for <filtered@awaresystems.be>; Thu,  2 Oct 2014 14:32:16 +0000 (UTC)
Received: by mail-la0-f43.google.com with SMTP id mc6so2527237lab.16
        for <filtered@awaresystems.be>; Thu, 02 Oct 2014 07:32:16 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:delivered-to:delivered-to:date
         :from:to:in-reply-to:message-id:references:user-agent:mime-version
         :cc:subject:precedence:list-id:list-unsubscribe:list-archive
         :list-post:list-help:list-subscribe:content-type
         :content-transfer-encoding:sender:errors-to;
        bh=GiHYw1q96MhIAAUsFF038uNVwgte9KXENR5iAvUwNuo=;
        b=jHVcal5geB65N63hCM8LemPVs5IjadF8hBacKbYzkXUvrn2Ef9XGPZim0/ng0n8Ed+
         PwGYekRbzGctQeqOPxsww5EQ9asyPzyZOZXZiy9OkIXPwCIx9unbPlNczVvZYcWwLPrs
         31kDnS4fwK5OYGK7QWJbHnYbCTM35R/MgXXypkejX07zfWMTXD8nkPlVelFNIuPHTekY
         eMVtzNeCum6xWZKl0+lIrEVY3PU6vGattq/v2mCNkSM8Kw260EIDZj8t7XyhyHzQOyBx
         PAL8G5j+xTPMY/QeAhtaGsOhtrupFbHYMSnOCKvHvALCss+vjQrlw2EREFmIRjHO2Cbl
         Os2Q==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) smtp.mail=tiff-bounces@lists.maptools.org
X-Received: by 10.152.20.1 with SMTP id j1mr63101103lae.57.1412260335858;
        Thu, 02 Oct 2014 07:32:15 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.114.111.103 with SMTP id ih7csp58377ldb;
        Thu, 2 Oct 2014 07:32:15 -0700 (PDT)
X-Received: by 10.153.7.134 with SMTP id dc6mr4323612lad.9.1412260334387;
        Thu, 02 Oct 2014 07:32:14 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=neutral (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) smtp.mail=tiff-bounces@lists.maptools.org
Received-SPF: none (google.com: tiff-bounces@lists.maptools.org does not designate permitted sender hosts) client-ip=91.198.169.52;
Received: by 10.112.34.139 with POP3 id z11mf2338525lbi.16;
        Thu, 02 Oct 2014 07:32:14 -0700 (PDT)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-e.one.com (mx-e.one.com [91.198.169.52])
	by mail6.local.one.com (Postfix) with ESMTP id CC04A3003063A0
	for <info@awaresystems.be>; Thu,  2 Oct 2014 13:57:25 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by mx-e.one.com (Postfix) with ESMTP id 9ED47DE430F
	for <info@awaresystems.be>; Thu,  2 Oct 2014 13:57:25 +0000 (UTC)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 2389E35C036;
	Thu,  2 Oct 2014 08:56:28 -0500 (EST)
Received: from blade.simplesystems.org (blade.simplesystems.org [65.66.246.74])
	by lists.maptools.org (Postfix) with ESMTPS id 8A7B635C036
	for <tiff@lists.maptools.org>; Thu,  2 Oct 2014 08:55:07 -0500 (EST)
Received: from freddy.simplesystems.org (freddy.simplesystems.org
	[65.66.246.65])
	by blade.simplesystems.org (8.14.4+Sun/8.14.4) with ESMTP id
	s92DtAoB014916; Thu, 2 Oct 2014 08:55:10 -0500 (CDT)
Date: Thu, 2 Oct 2014 08:55:10 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
X-X-Sender: bfriesen@freddy.simplesystems.org
To: Petr Hracek <phracek@redhat.com>
In-Reply-To: <542D3F52.3020601@redhat.com>
Message-ID: <alpine.GSO.2.01.1410020849100.18732@freddy.simplesystems.org>
References: <542D3F52.3020601@redhat.com>
User-Agent: Alpine 2.01 (GSO 1266 2009-07-14)
MIME-Version: 1.0
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.2
	(blade.simplesystems.org [65.66.246.90]);
	Thu, 02 Oct 2014 08:55:10 -0500 (CDT)
Cc: tiff@lists.maptools.org
Subject: Re: [Tiff] Vulnerability CVE-2010-2596
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On Thu, 2 Oct 2014, Petr Hracek wrote:

> Hi tiff folks,
>
> I would like to ask you whether CVE-2010-2596 is planned to be released
> in libtiff-3.9?
> http://bugzilla.maptools.org/show_bug.cgi?id=2209
>
> Similar code is mentioned aroung line 643 in tiff_ojpeg.c

Libtiff is certainly due for some new releases since it has not had a 
release since September, 2012.

Tom Lane's patch avoids the assertion but it apparently does not solve 
the parsing issue.

There are are many other fixes already in libtiff CVS waiting to be 
released.

Bob
-- 
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
