From: Thomas Bernard <thomas.bernard@cls.to>
Message-ID: <aaa63061-cf4c-1ae6-164f-e19806a64bbe@cls.to>
Subject: Re: [Tiff] Question about security vulnerabilities in tiff 4.0.10
Date: Thu, 2 Apr 2020 09:00:00 +0000

I believe all information is available in the gitlab repository :
https://gitlab.com/libtiff/libtiff
so you could do the verification yourself.

* https://nvd.nist.gov/vuln/detail/CVE-2019-6128 / http://bugzilla.maptools.org/show_bug.cgi?id=2836
Was fixed here :
https://gitlab.com/libtiff/libtiff/commit/ae0bed1fe530a82faf2e9ea1775109dbf301a971
this change is included in v4.1.0

* https://nvd.nist.gov/vuln/detail/CVE-2019-14973
fixed here :
https://gitlab.com/libtiff/libtiff/-/commit/1b5e3b6a23827c33acf19ad50ce5ce78f12b3773
this change is included in v4.1.0

* https://nvd.nist.gov/vuln/detail/CVE-2019-17546
https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145
this change is included in v4.1.0

* https://nvd.nist.gov/vuln/detail/CVE-2019-7663
https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17a6a2d39
this change is included in v4.1.0


Le 01/04/2020 ? 21:00, tiff-request@lists.osgeo.org a ?crit?:
> Date: Wed, 1 Apr 2020 18:25:28 +0000
> From: Nalini Vishnoi <nvishnoi@mathworks.com>
> To: "tiff@lists.osgeo.org" <tiff@lists.osgeo.org>
> Subject: [Tiff] Question about security vulnerabilities in tiff 4.0.10
> Message-ID:
> 	
> <BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90@BL0PR05MB4852.namprd05.prod.ou
> tlook.com>
> 	
> Content-Type: text/plain; charset="windows-1252"
>
> Hello Tiff team,
>
> I am using tiff version 4.0.10 and I recently came across the following security vulnerabilities in this version:
> https://nvd.nist.gov/vuln/detail/CVE-2019-6128
> st.gov 
> https://nvd.nist.gov/vuln/detail/CVE-2019-14973
> st.gov 
> https://nvd.nist.gov/vuln/detail/CVE-2019-17546
> st.gov 
> https://nvd.nist.gov/vuln/detail/CVE-2019-7663
> st.gov
>
> I wanted to check if these are fixed in the latest tiff library (4.1.0). I can see at least one<https://nvd.nist.gov/vuln/detail/CVE-2019-17546> of them excludes 4.1.0.
>
> Can you please verify if all of these vulnerabilities are fixed in 4.1.0? If not, are there plans to provide patches to fix them in the older versions?
>
> Thanks and regards,
> Nalini
>


--
Thomas Bernard - thomas.bernard@cls.to
Conseil Logiciel Securite SAS
1 passage du Surmelin
75020 Paris
Tel: +33 9 52 53 61 63
Cellulaire : +33 6 69 95 24 79
Fax: +33 9 57 53 61 63

_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tif
