Return-Path: <tiff-bounces@lists.osgeo.org>
Received: from mailgate112.isp.belgacom.be ([195.238.20.44])
          by mailfep008.skynet.be
          (InterMail vM.8.04.03.28.4 201-2389-100-182-103-20180124)
          with ESMTP
          id <20200401183221.YYAZ7185.mailfep008.skynet.be@mailgate112.isp.belgacom.be>
          for <chris.lindelaan@skynet.be>; Wed, 1 Apr 2020 20:32:21 +0200
Received-SPF: None (mx101.skynet.be: no sender authenticity
  information available from domain of
  tiff-bounces@lists.osgeo.org) identity=pra;
  client-ip=140.211.15.3; receiver=mx101.skynet.be;
  envelope-from="tiff-bounces@lists.osgeo.org";
  x-sender="tiff-bounces@lists.osgeo.org";
  x-conformance=sidf_compatible
Received-SPF: Pass (mx101.skynet.be: domain of
  tiff-bounces@lists.osgeo.org designates 140.211.15.3 as
  permitted sender) identity=mailfrom; client-ip=140.211.15.3;
  receiver=mx101.skynet.be;
  envelope-from="tiff-bounces@lists.osgeo.org";
  x-sender="tiff-bounces@lists.osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text="v=spf1 mx a:mail.osgeo.org a:lists.osgeo.org
  a:mail.osgeo.osuosl.org a:tracsvn.osgeo.osuosl.org -all"
Received-SPF: Pass (mx101.skynet.be: domain of
  postmaster@lists.osgeo.org designates 140.211.15.3 as
  permitted sender) identity=helo; client-ip=140.211.15.3;
  receiver=mx101.skynet.be;
  envelope-from="tiff-bounces@lists.osgeo.org";
  x-sender="postmaster@lists.osgeo.org";
  x-conformance=sidf_compatible; x-record-type="v=spf1";
  x-record-text="v=spf1 mx a:mail.osgeo.org a:lists.osgeo.org
  a:mail.osgeo.osuosl.org a:tracsvn.osgeo.osuosl.org -all"
Authentication-Results: mx101.skynet.be; spf=None smtp.pra=tiff-bounces@lists.osgeo.org; spf=Pass smtp.mailfrom=tiff-bounces@lists.osgeo.org; spf=Pass smtp.helo=postmaster@lists.osgeo.org; dkim=hardfail (body hash did not verify [final]) header.i=@mathworks.com
X-Ironport-Dmarc-Check-Result: validskip
IronPort-SDR: usnJ5RTvyXdEV0AxretQMPLd8s7aEujDhdmA+WgOmD4v7Hp+SCCyybHvcl56V4Sc8gvXZMgMn0
 jeIGTnEq33a/M1uWaNnXml9MGXnh6xUlmZHWwNKBRAPrCM/dsM9TWyUuImNq/LdbSPugi+gDBT
 Qk0n0kWLjLCu21Z7MGS2u8erSobWrXTdl/dTRaqAOb0hwr0ZRyRn9xHuumI6l6KOKFdrae5vM0
 3VFir8+SEtFk+AOvXcckFTaTg58gDbNgPMupczpXE/N5IszIqOlYOlaZ1T+fyE8QuWRUOIoHlL
 s01slN92EB2d3KpwA/4/ehYI
IronPort-PHdr: =?us-ascii?q?9a23=3Awzt7rxK5ER/L8LwMVdmcpTZWNBhigK39O0sv0r?=
 =?us-ascii?q?FitYgXK/v8rarrMEGX3/hxlliBBdydt6sZzbKM+Pm6AyRAuc/H7CleNsQUFl?=
 =?us-ascii?q?cssoY/oU8JOIa9E0r1LfrnPWQRPf9pcxtbxUy9KlVfA83kZlff8TWY5D8WHQ?=
 =?us-ascii?q?jjZ0IufrymUoHdgN6q2O+s5pbdfxtHhCanYbN1MR66sRjdutMZjId/Kqs90A?=
 =?us-ascii?q?fFrmVHd+hL229kO0+YkxLg6sut5pJu/Dlctv07+8JcTan2erkzQKBFAjghL2?=
 =?us-ascii?q?0668rnuAXZQwCS/HUcSGIWkhRJAwjB8h73W4r6vzX5uORgxiSUJNX6Qr8oVz?=
 =?us-ascii?q?us6adrUwLohzwcNzEl6mHXi9d/g7xdrRm8uhFw2Y/UYIWSNPpjYqPQeM4RSG?=
 =?us-ascii?q?RdUspNUSFKH42zb5ELD+EcI+hWqYfzrEYKoRenBASgAeXiwSJKiHDrx603y+?=
 =?us-ascii?q?QvHx/a3AIuHNwOsXvbosjtNKoQU+650afFwSnfYPxIwjfw843Ifgw9rfyWQb?=
 =?us-ascii?q?58bdTdxE8yHA3FlFWQronlMiuN2OsXt2ib7uxgVeOygGEoqgFxuTivxsErio?=
 =?us-ascii?q?nIm4kYzVbE9Tt4wIYuJd24Tkl7Yd+/HZtVrS6aK4t2Q80lQ2FyuyY60acKto?=
 =?us-ascii?q?K8fCgP0ZkqwQPUZfKAc4iN+B3jVeCRLC9+hHJkY7K/mwy+8Uenyu3iUMS/zV?=
 =?us-ascii?q?VErjJdn9XRuX0Bywbf5taaRvdg5EutxDaC2xrd5+1cPEw5mqXWJ4Q/zrItiJ?=
 =?us-ascii?q?Yfq0rOEjX5lUnugq+ZaEYp9vSt5unibLjpu5uRO5Nxhw7lLKgjmcmyDOUkPg?=
 =?us-ascii?q?UKQmeW/Piz26ft8ED4RrhBk+c4nbPDsJ/AIMQWvq65DBFR0oYk8xu/Czam0M?=
 =?us-ascii?q?8EnXkcNl5FfwmHj4f3NFHJOvz4Cu2/g1u0nDdqwfDJIKHhD43QInXMjLvtZ6?=
 =?us-ascii?q?hx51NBxAYp0NxS54hYB78ZLPL2QEDxtdjYDhEjMwyzxubqEMl91oIQWWKBG6?=
 =?us-ascii?q?OWK6TSsUKO5u0zPeaMf5QYuDL8K/g++/7ulmU1mVgGfammw5QXb2q0HvN8I0?=
 =?us-ascii?q?WWeXbsmMsOEX8WvgoiS+znkEGNUT5JZ3azRKIw/DU7CIOgDYjeWI+thKaO0z?=
 =?us-ascii?q?29HpBNfWBGCVCNEXH2eIWYQfsDczydcYdclCcZX+2hV5M5zkPp8wv70KZ8aO?=
 =?us-ascii?q?3P9SAf85X5259w7uzXkBg0sjtsE8Wa1XrKU2B6kDA1QSQr1vV6qE151lDRza?=
 =?us-ascii?q?l2jblCGMVO6uhVegM7LoLHiethBN31HAXbcYCSVVykT966VCw3Vc872NQUYk?=
 =?us-ascii?q?xwSOiklQ3J/yejD7IPwryXGIQvoOWb23nqO907zG3J2a5niEMpBc5GNGmjj6?=
 =?us-ascii?q?g48BDPBonPiAKFlqikJpkaxzPH1GqKwWeU6URRUQpsVvfZXH4RI1HbtMn0/V?=
 =?us-ascii?q?/qS761Fa9hNRBOxMnELbFFPcb0h1dLT+u2JdLFfmiqkH2xDxvb+rTZJpbrdW?=
 =?us-ascii?q?s12CTGFFNClBsc8HHAMhIxTG/1v2PQAhRqFEnzeAXr6uZzrzW8VEBinC+QaE?=
 =?us-ascii?q?g08bOx+xgUzcKdUPMV2bNM7CE/qi50GlG899ffF9qfoBBiZ+NXZtZrswQP7n?=
 =?us-ascii?q?7QqwEoZs/oFKtlnFNLNlou4hHC9DRST6hemMw3pW8rywwvdfrKzgYYJHuRiI?=
 =?us-ascii?q?rrM/jMKmCooU78I6WDwFza2cab9uAV5fAxu1jv70mlQ08r73V41MNWyD2X4Z?=
 =?us-ascii?q?CZaWhaSsf0U0M6/BFhu+uCO3llvtqLhjVwZPDp4mKdhY94XLV2r3Tof4JRKq?=
 =?us-ascii?q?SBRgHoFMhIHcW2LP1vh1/7dQ8OPu1Z6PwvIsmkevCaiqKiIOsykDu6gDZC7Z?=
 =?us-ascii?q?tm202BsitwGOvFxI0MzPzd3wfVMlW0kFDzrselkosWYDAXEy+hxDL/BYlXNK?=
 =?us-ascii?q?hzeItOF2q0OMywwId1gJjxVnhEsUKyH15U08ivZReUcxnhzBVdhiF16XanzC?=
 =?us-ascii?q?uG9Rl7jjMGhLSC8Tfg8sXJRBxeO0RyTzhJr2nSBIe4tfdZWhj0Sg1zihDwti?=
 =?us-ascii?q?OYj6IOm59aCVnebG1GdXPfNWJHSZmdqr6heZEI64Et6XxbUMuzf3yhSbPTiA?=
 =?us-ascii?q?MH7h/IHltU+hYCbhGQtMTXnRB0gjytdUxXqVSFf6QSjUaP/Yz1ZcJh5zgoXw?=
 =?us-ascii?q?YmhXrQNHa9HcO1xfTEkL3vmdmxfViTULlJUDHq6aaLuDC87jxDLyCyguHoxI?=
 =?us-ascii?q?HZDTA71wLH6utpWxytzl7FZ6rki73mDLxMWWsvDkKns8wrJL0nm6VhgM5B9E?=
 =?us-ascii?q?JG08bd7T8Gi2D1KdJBxefkYWEQQSJew9fP7Abs2UkwZmLMxpj+UG2a2Nckas?=
 =?us-ascii?q?OgZXlD0CUx/ohKAbyUpLBFkWNzpUbwsw/LYPZs1gQTyP0n7EtJ2btbkRcxzi?=
 =?us-ascii?q?ibHrEZFFVZOiqprRmT8tSit/8MOzSqYeHojQxlnsGnAa3EqAwPEG3hdMIEGi?=
 =?us-ascii?q?l9pt56LEqKyGf6v53ldteVZ9UOsBaZiD/EjvNJM9Q2jfUHgmxgI22u9WY9xb?=
 =?us-ascii?q?sDhAd1lYq/oJDBLmxs+KyjBRsNKjz7aYYZ/SzrhqtFtsKXxJy0WJJ6FTgMGp?=
 =?us-ascii?q?zyQqHgCyoc4MzuLB3GCzggsjGbFL7YSBeY81tjpmnTHoqDM3CMOGJfys5tSR?=
 =?us-ascii?q?7bI1ZQ00gYXzQ/y54wDAykzc3lOAdz4TwArl7xsRsExuNkfx/4Ti/BqR2pZC?=
 =?us-ascii?q?Z8e5aeKhNS20AK50rcPcGEqOMmNyRR4p2+qxaOMSqQYAERVzMzV0eJBk7uMv?=
 =?us-ascii?q?yV3febqrHKIO24IrOOZKXX8bUYTPSZw5+zlIFrrX6KMY2UM39uAudz01dfXX?=
 =?us-ascii?q?1/B8XSmikeLk5f3yPLYcmBoR6g+ypx5smh+fXvUQjr6MOBEbxXedlo/hm3h+?=
 =?us-ascii?q?+EOYvyzG5lKDhWk5kL2HnDxaM32F8JlzoocCKiHLNGsjTCDerRlqJREx8Hen?=
 =?us-ascii?q?ZrLsIbisB0lgJJOMPdlpb0zush0qZzUQ4cEwW83Jr6LdYHKGy8Kl7dUUObbe?=
 =?us-ascii?q?zfYybI0sf6feW2RO417q0cuhuutDKcC0KmMC6EkmyjSxGhP6RGizydNxFFkI?=
 =?us-ascii?q?W8aQp2T2/4Q9/hLBqhP5Uk6F9+ia1xnX7MOWMGZHJgck1D67eX8CVTj+5XH2?=
 =?us-ascii?q?1a8mEjKvKLliHf6PPXYMVz07MjEmF/kORU524/wr1e4XRfRfB7ryDVq8Znv1?=
 =?us-ascii?q?CsluTWkGhdXRFDqyhGiMewhWs+ZPWLzpBbQj6E+QJUtTzWEBcbodZ5TNfi6e?=
 =?us-ascii?q?hczd3GlaS7LzknkZqc4coSCY3eL9+BO3c6GR7oAyLPSgweQjOsc2bFiARRne?=
 =?us-ascii?q?qT+XucspUh4sGwwNxUE+YdDQFzTbsTESEHVJQaLY1yXy84nLLTl8MO6Xek7V?=
 =?us-ascii?q?HQSMhcopHbR6eXCPTrJiyeiOoMbB8JzLXkaIULY9Sngwo4MwA8xdmMQBm1P5?=
 =?us-ascii?q?gFuCBqYw4qrV8Y9WgnFjR1wEH0bA6xpnUeRpvW1lY7jBVzZeM1+XLi+VAycx?=
 =?us-ascii?q?DWpSU+1UM2hNPujCu5dD/qMLz2WppZBi2ysFI+eMCeIU49fUipkEpoOS2RDa?=
 =?us-ascii?q?5QgbUlf2d2jgTRorNLGOVAVutDexAdwreQffpigjE+4m23gERA4+XCE55rkg?=
 =?us-ascii?q?AnJIWto3x30AVmdNcpJKbUKfkB3h1Ki6mJpCPtyvEpzVpUORMW6G3LMn1t2g?=
 =?us-ascii?q?RAJvw8KiGv5OAp9QGSh24JZj0XT/Rz6vd6vkpvPu2By2TnyLFOLQa2LePXJv?=
 =?us-ascii?q?GdunPcjoiPWVw90QUPjUYgn/A+2JUmekuQEUc0w7aWURMSKM3ZLUdSdcUa/S?=
 =?us-ascii?q?rPZy+FqvvLh5VuMIi6UOfzUOiVsOATmE3sWQ8tG85VtJY7E5Kh0V/VIYLcFJ?=
 =?us-ascii?q?BZlE1/3A3wPx3FCeQQIEvNizQWpcyjipV6j8FRITQUAGM1NivShP6fvggxnP?=
 =?us-ascii?q?+KR8s7eF8eX5AYLTQxQ8K3nGhepXsIADSs0+0fwRSP9Hel+nyWVmClKYM+Iq?=
 =?us-ascii?q?zcbAgJapn+4Tgl9qmqlVPbuo7TIW33L5Uqu9PC7/8bu4fSC/5QSuo1uEPdlo?=
 =?us-ascii?q?9EAn2yBjeTSZjvfsG2MtRqNo+RaD7ySFG0hjMrQt2kOcb0dvHOmgL5Q4tI9o?=
 =?us-ascii?q?OWj1VBfYewEC8THxBoqqQN/qV5MEcfYpQ1JBTvqgI1OreXJAaDzs7oRH2iJD?=
 =?us-ascii?q?wQSONQh7bfBfQf3283Y+m2xWF1BIk91PWy+FURSYsiihDF2e3lYJJRXC+1HW?=
 =?us-ascii?q?ZSMVaqx2Jxhy1qMeA8xf06yRXDvAwHMjyFQ+dubXRNo9A2AV7BaWUzEGczQE?=
 =?us-ascii?q?WQyJbS+gP5la5H5DNTxpwHtI8N+Gi7pJLUZyigHbCmuYmA+TR1dsAo+uV0Ic?=
 =?us-ascii?q?TqcM6PtZeYmSfQQZ6WtReKGCfoE/tBhsMWJzlXTf4OnnsqXK5O8YMT7EMwUo?=
 =?us-ascii?q?E5PLNCD+8rva2tcj4iCjQdhSZLS5mJ1ycchKG7wLTXkVGXa4klKxhCt49Nyp?=
 =?us-ascii?q?4UVyo8O3JMlOqYT4zT0lS8ZC0OKQYX4x5L4VtfxItxZfz+po3TQ5JLjTlMrK?=
 =?us-ascii?q?AtC3eZJtxT71L+D1qurx3gUvz4zL6t3BlO17TrydYWX1h4E0cPn78LxHttE6?=
 =?us-ascii?q?l+LuwrhqCPsjKMchql7mbs0/e9Yl5KxsDTMVriA9icuA=3D=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0GiAQDu3YRehwMP04xmHgELHIFwC4E?=
 =?us-ascii?q?lL1BxdQMHMgqEEINFA4U6iCiTKIYPgT8XGhUBAQIBAQEBAQgYAQoKAgQBAQE?=
 =?us-ascii?q?BhEIZgj8GAQQwCQ4CAQIBAQEDAgUBAQEEAQEBAgEBAQMCAgEBAhABAQEIDQk?=
 =?us-ascii?q?IKSkGZVoEYgZbBIFiCQcDLwELgjsFAgMfB2hFOQEBAQEBAQEBAQEBAQEBAQE?=
 =?us-ascii?q?BAQEBAQEBAQEBDwINEiQeEiUSASABAQQBAQ8RChMBAQQKHgwCAwECBgIBATk?=
 =?us-ascii?q?CBwQEAgICAQEjAQomAQQTBQMagwQBgnwBBAqkJgICgTeIYQEBAQFygTKCfwE?=
 =?us-ascii?q?BBYEzBQlDhA+BNQMGgTiFIoVxgTiBQT+BWIVyAQSCDzECgjIygiyON4JNhyS?=
 =?us-ascii?q?YXIJHh2iJTIYJgkyIM5BzjyeJHZJxAgQCBAUCDgEBBYFSOYFGCwgzGggbFTu?=
 =?us-ascii?q?CbE0BAgECDQIBAgEBAQICAgEBAgIBAQKOGoNzgX+DFYVBdIEpP4sMV1oBgQ8?=
 =?us-ascii?q?BAQ?=
X-IPAS-Result: =?us-ascii?q?A0GiAQDu3YRehwMP04xmHgELHIFwC4ElL1BxdQMHMgqEE?=
 =?us-ascii?q?INFA4U6iCiTKIYPgT8XGhUBAQIBAQEBAQgYAQoKAgQBAQEBhEIZgj8GAQQwC?=
 =?us-ascii?q?Q4CAQIBAQEDAgUBAQEEAQEBAgEBAQMCAgEBAhABAQEIDQkIKSkGZVoEYgZbB?=
 =?us-ascii?q?IFiCQcDLwELgjsFAgMfB2hFOQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD?=
 =?us-ascii?q?wINEiQeEiUSASABAQQBAQ8RChMBAQQKHgwCAwECBgIBATkCBwQEAgICAQEjA?=
 =?us-ascii?q?QomAQQTBQMagwQBgnwBBAqkJgICgTeIYQEBAQFygTKCfwEBBYEzBQlDhA+BN?=
 =?us-ascii?q?QMGgTiFIoVxgTiBQT+BWIVyAQSCDzECgjIygiyON4JNhySYXIJHh2iJTIYJg?=
 =?us-ascii?q?kyIM5BzjyeJHZJxAgQCBAUCDgEBBYFSOYFGCwgzGggbFTuCbE0BAgECDQIBA?=
 =?us-ascii?q?gEBAQICAgEBAgIBAQKOGoNzgX+DFYVBdIEpP4sMV1oBgQ8BAQ?=
X-MGA-submission: =?us-ascii?q?MDHhFqI8jPGbam53HBO+DpMHUBQ3SeVoPbiPFg?=
 =?us-ascii?q?lDONRanMrgUZT+/uqBCRvXjhKuHfNWYWXe4X4FdjWBtBR+V3oFSls8kk?=
 =?us-ascii?q?PDgHOHy5ga+2b6ciINeyYdOm5AgFCwtnQU06I=3D?=
Received: from osgeo6.osgeo.osuosl.org (HELO lists.osgeo.org) ([140.211.15.3])
  by mx101.skynet.be with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 01 Apr 2020 20:31:56 +0200
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id 17DB66144E72;
	Wed,  1 Apr 2020 11:31:49 -0700 (PDT)
X-Greylist: delayed 305 seconds by postgrey-1.35 at osgeo6;
 Wed, 01 Apr 2020 11:31:47 PDT
Received: from us-smtp-delivery-1.mimecast.com (us-smtp-1.mimecast.com
 [207.211.31.81])
 by lists.osgeo.org (Postfix) with ESMTP id B4A85614663D
 for <tiff@lists.osgeo.org>; Wed,  1 Apr 2020 11:31:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mathworks.com;
 s=mimecast20180117; t=1585765906;
 h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
 to:to:cc:mime-version:mime-version:content-type:content-type;
 bh=hVRMgujGBvuEsFYICXn1iBQc9CJVVMgdRO+n84Mm2vc=;
 b=WSMNXeEBfb3ArkMsZEtlKr7/kzm01dhGgvDSkeFCpuUTCiXbVNQqHRf9Fjdfb6X1RLmF4n
 98q8AHTXQjFsG6d+oZFiJrtPI8oBDCQgBRZnLrIpiLMcdsoc9AFUeuy364VtPinETUZkfQ
 QmKg4q4U6COJ/bu30n9VT1aF9l79ER4=
Received: from NAM11-CO1-obe.outbound.protection.outlook.com
 (mail-co1nam11lp2168.outbound.protection.outlook.com [104.47.56.168])
 (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-308-sPbCzhr5OAqWiRzOxyaa_A-1; Wed, 01 Apr 2020 14:25:30 -0400
X-MC-Unique: sPbCzhr5OAqWiRzOxyaa_A-1
Received: from BL0PR05MB4852.namprd05.prod.outlook.com (2603:10b6:208:57::10)
 by BL0PR05MB4706.namprd05.prod.outlook.com (2603:10b6:208:58::28)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.15; Wed, 1 Apr
 2020 18:25:28 +0000
Received: from BL0PR05MB4852.namprd05.prod.outlook.com
 ([fe80::3d90:b28:609d:ca36]) by BL0PR05MB4852.namprd05.prod.outlook.com
 ([fe80::3d90:b28:609d:ca36%7]) with mapi id 15.20.2878.013; Wed, 1 Apr 2020
 18:25:28 +0000
From: Nalini Vishnoi <nvishnoi@mathworks.com>
To: "tiff@lists.osgeo.org" <tiff@lists.osgeo.org>
Thread-Topic: Question about security vulnerabilities in tiff 4.0.10
Thread-Index: AdYIUZ/pRGjYMR3LSLKALa/dk707uw==
Date: Wed, 1 Apr 2020 18:25:28 +0000
Message-ID: <BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90@BL0PR05MB4852.namprd05.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [144.212.3.4]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 2f040d05-8161-437a-0eca-08d7d66a0e16
x-ms-traffictypediagnostic: BL0PR05MB4706:
x-microsoft-antispam-prvs: <BL0PR05MB4706891E9C161CAFC743A025D5C90@BL0PR05MB4706.namprd05.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 03607C04F0
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
 IPV:NLI; SFV:NSPM; H:BL0PR05MB4852.namprd05.prod.outlook.com; PTR:; CAT:NONE;
 SFTY:;
 SFS:(10009020)(4636009)(366004)(376002)(346002)(39860400002)(136003)(396003)(186003)(33656002)(26005)(5660300002)(15650500001)(81156014)(8936002)(6506007)(7696005)(478600001)(966005)(81166006)(2906002)(66556008)(76116006)(9686003)(64756008)(66446008)(52536014)(316002)(6916009)(71200400001)(66946007)(55016002)(8676002)(66476007)(4744005)(86362001);
 DIR:OUT; SFP:1101; 
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:  
x-ms-exchange-antispam-messagedata: 7u8oArhaH+rxB6yntjWBht7dwSqzXN7VBToXbbg72+AsgZ4jkvINEfbEhybdoHfrcT9/+ynVXFPpcmrFBY9bKhoKnPXqwYxg+9e8T6JpzIxNNzs9OYU/5M7+VtTSygr9cu9q0tqyE3a90830Vx181Q==
x-ms-exchange-transport-forked: True
MIME-Version: 1.0
X-OriginatorOrg: mathworks.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2f040d05-8161-437a-0eca-08d7d66a0e16
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2020 18:25:28.6159 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 99dd3a11-4348-4468-9bdd-e5072b1dc1e6
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: W781aH0UTtnj2WPtRXb1B0Sao0v7qsDunHQWwC+cDsLDh/TcZqMdqT1XpB0x1t0ZsQKr1WklcIDBGvEnMqwb6Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR05MB4706
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: mathworks.com
Subject: [Tiff] Question about security vulnerabilities in tiff 4.0.10
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============7663690780892221245=="
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>

--===============7663690780892221245==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90BL0PR05MB4852namp_"

--_000_BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90BL0PR05MB4852namp_
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

Hello Tiff team,

I am using tiff version 4.0.10 and I recently came across the following sec=
urity vulnerabilities in this version:
https://nvd.nist.gov/vuln/detail/CVE-2019-6128
https://nvd.nist.gov/vuln/detail/CVE-2019-14973
https://nvd.nist.gov/vuln/detail/CVE-2019-17546
https://nvd.nist.gov/vuln/detail/CVE-2019-7663

I wanted to check if these are fixed in the latest tiff library (4.1.0). I =
can see at least one<https://nvd.nist.gov/vuln/detail/CVE-2019-17546> of th=
em excludes 4.1.0.

Can you please verify if all of these vulnerabilities are fixed in 4.1.0? I=
f not, are there plans to provide patches to fix them in the older versions=
?

Thanks and regards,
Nalini



--_000_BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90BL0PR05MB4852namp_
Content-Type: text/html; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
=09{font-family:"Cambria Math";
=09panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
=09{font-family:Calibri;
=09panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
=09{margin:0in;
=09margin-bottom:.0001pt;
=09font-size:11.0pt;
=09font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
=09{mso-style-priority:99;
=09color:#0563C1;
=09text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
=09{mso-style-priority:99;
=09color:#954F72;
=09text-decoration:underline;}
span.EmailStyle17
=09{mso-style-type:personal-compose;
=09font-family:"Calibri",sans-serif;
=09color:windowtext;}
.MsoChpDefault
=09{mso-style-type:export-only;
=09font-family:"Calibri",sans-serif;}
@page WordSection1
=09{size:8.5in 11.0in;
=09margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
=09{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Hello Tiff team, <o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">I am using tiff version 4.0.10 and I recently came a=
cross the following security vulnerabilities in this version:<o:p></o:p></p=
>
<p class=3D"MsoNormal"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019=
-6128">https://nvd.nist.gov/vuln/detail/CVE-2019-6128</a><o:p></o:p></p>
<p class=3D"MsoNormal"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019=
-14973">https://nvd.nist.gov/vuln/detail/CVE-2019-14973</a><o:p></o:p></p>
<p class=3D"MsoNormal"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019=
-17546">https://nvd.nist.gov/vuln/detail/CVE-2019-17546</a><o:p></o:p></p>
<p class=3D"MsoNormal"><a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019=
-7663">https://nvd.nist.gov/vuln/detail/CVE-2019-7663</a><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">I wanted to check if these are fixed in the latest t=
iff library (4.1.0). I can see at least
<a href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019-17546">one</a> of them=
 excludes 4.1.0.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Can you please verify if all of these vulnerabilitie=
s are fixed in 4.1.0? If not, are there plans to provide patches to fix the=
m in the older versions?<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Thanks and regards,<o:p></o:p></p>
<p class=3D"MsoNormal">Nalini <o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>

--_000_BL0PR05MB4852D6C49D9BB1298EF3A98FD5C90BL0PR05MB4852namp_--


--===============7663690780892221245==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KVGlmZiBtYWls
aW5nIGxpc3QKVGlmZkBsaXN0cy5vc2dlby5vcmcKaHR0cHM6Ly9saXN0cy5vc2dlby5vcmcvbWFp
bG1hbi9saXN0aW5mby90aWZmCg==

--===============7663690780892221245==--

