Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: <filtered@awaresystems.be>
Received: from mx2.public.one.com ([10.246.18.22])
	by mail6.local.one.com (Dovecot) with LMTP id hlpICWpg5Vej0AAAsyOMew
	for <filtered@awaresystems.be>; Fri, 23 Sep 2016 17:13:13 +0000
X-HalOne-ID: 0220d14a-81b1-11e6-80b0-b82a72d88088
Received: from mail-qt0-f180.google.com (unknown [209.85.216.180])
	by mx2.public.one.com (Halon Mail Gateway) with ESMTPS
	for <filtered@awaresystems.be>; Fri, 23 Sep 2016 17:13:12 +0000 (UTC)
Received: by mail-qt0-f180.google.com with SMTP id 38so55465603qte.1
        for <filtered@awaresystems.be>; Fri, 23 Sep 2016 10:13:12 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:x-gm-message-state:delivered-to
         :message-id:date:from:user-agent:mime-version:to:references
         :in-reply-to:subject:precedence:list-id:list-unsubscribe
         :list-archive:list-post:list-help:list-subscribe
         :content-transfer-encoding:sender:errors-to;
        bh=ZZL90QisgLSInL6RJcn3+ktRGJk4gaqWXJ8RuJyQG7w=;
        b=FvslWZmIMtyWPHvEwFucJ2ENhzJFgKkNGiBvjRKE1rtfahMKQQX02drvkT8oh1QLVP
         BmECYaPgG3VyE2idPjXa/UzeJwka3fy0W1lTDwY7Sd7UQYQBn3dl/JKYWNQcveu1hu2r
         Mu+1MUSBduytrKFwkV4JboLcxlbILnRe1YsXIw2WEBAg/6xajPXXteLOxcPqA9zFCh6t
         9vdcJaRhUISB4Wys2BpznAEqnJRSTJ0I0hK/RtWmk2Kj5Icvp1g15ygLPo/brBOYBU8A
         /uIp5nt+l4ROAIiNpKTZZq4pX/uQvDqd06YkdhiBPpUh8yrouqFZ4jrMJz+zr46b0PxR
         AA2w==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
X-Gm-Message-State: AA6/9Rlcfy1+KahD20VRI0+vl+z+WSMbWho621TWKqC+qTEkq4QodsqvGWXsT/eWr3owrrEHb1a7I2UBy1eIuWHf04BMvMQ=
X-Received: by 10.237.41.6 with SMTP id s6mr8786576qtd.153.1474650790940;
        Fri, 23 Sep 2016 10:13:10 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.55.161.4 with SMTP id k4csp645595qke;
        Fri, 23 Sep 2016 10:13:09 -0700 (PDT)
X-Received: by 10.194.95.105 with SMTP id dj9mr8288220wjb.20.1474650789773;
        Fri, 23 Sep 2016 10:13:09 -0700 (PDT)
Return-Path: <tiff-bounces@lists.maptools.org>
Received: from lists.maptools.org (ks365428.kimsufi.com. [94.23.4.142])
        by mx.google.com with ESMTP id l3si8420937wje.49.2016.09.23.10.13.03;
        Fri, 23 Sep 2016 10:13:09 -0700 (PDT)
Received-SPF: neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=94.23.4.142;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id E62B835C0E1;
	Fri, 23 Sep 2016 12:12:16 -0500 (EST)
Received: from mail.howardsilvan.com (fangorn.howardsilvan.com
	[216.235.106.115])
	by lists.maptools.org (Postfix) with ESMTPS id A4C5D35C079
	for <tiff@lists.maptools.org>; Fri, 23 Sep 2016 12:03:49 -0500 (EST)
Received: from bilbo.x101.com (localhost [127.0.0.1])
	by mail.howardsilvan.com (Postfix) with ESMTPSA id A1D3FC421BF
	for <tiff@lists.maptools.org>; Fri, 23 Sep 2016 10:03:42 -0700 (PDT)
Received: from bilbo.x101.com ([216.235.102.119] helo=bilbo.x101.com) by
	fangorn.howardsilvan.com with SMTP (2.3.3); 23 Sep 2016 10:03:42 -0700
Message-ID: <57E56072.2030406@howardsilvan.com>
Date: Fri, 23 Sep 2016 10:03:46 -0700
From: Lee Howard <faxguy@howardsilvan.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:17.0) Gecko/20130110 Thunderbird/17.0.2
MIME-Version: 1.0
To: tiff@lists.maptools.org
References: <43339E27-2FDC-4098-8C06-5A16C1D1C8FC@cisco.com>
	<alpine.GSO.2.20.1609230958550.5577@freddy.simplesystems.org>
In-Reply-To: <alpine.GSO.2.20.1609230958550.5577@freddy.simplesystems.org>
X-Assp-Version: 2.3.3(14029) on fangorn.howardsilvan.com
X-Assp-ID: fangorn.howardsilvan.com m1-50222-01981
X-Assp-Session: 7F0586C61EF0 (mail 1)
X-Assp-Envelope-From: faxguy@howardsilvan.com
X-Assp-Intended-For: tiff@lists.maptools.org
X-Assp-Server-TLS: yes
Subject: Re: [Tiff] LibTIFF vulnerabilities
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On 09/23/2016 08:15 AM, Bob Friesenhahn wrote:
> While a fix may be commited to libtiff CVS expediently, this does not 
> necessarily result in an expedient fix to the millions of copies of 
> libtiff which are already in use.

Ideally there would be a coordinated release that involved packages at 
as many distributions as possible... RedHat, SuSE, Fedora, Debian, 
Ubuntu, etc.

That said, the most-recently fixed vulnerabilities were in the tools 
side rather than the library side... so that mitigates the risks 
considerably.  If these vulnerabilities are similarly risk-mitigated, 
then the effort for a coordinated release may not be wholly necessary or 
even more-productive than an earlier announcement.

Thanks,

Lee.
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
