Bug 973340 (CVE-2016-3186) - VUL-0: CVE-2016-3186: tiff: buffer overflow in gif2tiff
Summary: VUL-0: CVE-2016-3186: tiff: buffer overflow in gif2tiff
Status: RESOLVED FIXED
Alias: CVE-2016-3186
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Fridrich Strba
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/165163/
Whiteboard: CVSSv2:SUSE:CVE-2016-3186:4.3:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-31 07:54 UTC by Johannes Segitz
Modified: 2016-10-24 10:26 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Patch to fix the buffer overflow (498 bytes, patch)
2016-04-06 14:03 UTC, Fridrich Strba
Details | Diff
CVE-2016-3186.gif (20 bytes, image/gif)
2016-10-06 09:49 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2016-03-31 07:54:19 UTC
rh#1319666
A buffer overflow vulnerability was reported in libtiff library, in gif2tiff component. A maliciously crafted file could cause the application to crash.

Reproducer and crash analysis linked in
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1319666
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3186.html
Comment 1 Swamp Workflow Management 2016-03-31 22:00:31 UTC
bugbot adjusting priority
Comment 2 Victor Pereira 2016-04-05 14:50:36 UTC
all codestreams are affected. However there isn't an available patch. 

Fridrich Strba could you come up with a patch?
Comment 3 Fridrich Strba 2016-04-06 14:03:37 UTC
Created attachment 671875 [details]
Patch to fix the buffer overflow

When getc detects that that it is at the end of file, it returns EOF which is a negative number. The exact value depends on implementation, but it is always a negative number. On Linux it is normally -1. That while loop check only if the count is <= 255. If the number count is negative, that condition is satisfied. Nonetheless, in the subsequent fread, the count is casted to size_t where it becomes a huge number, hence the buffer overflow. This patch is adding a check for the return of getc being positive, which solves the buffer overflow.
I am producing packages for affected systems and will submit ASAP.
Comment 4 Bernhard Wiedemann 2016-04-06 15:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (973340) was mentioned in
https://build.opensuse.org/request/show/385377 Factory / tiff
https://build.opensuse.org/request/show/385380 13.2 / tiff
https://build.opensuse.org/request/show/385383 13.1 / tiff
Comment 6 Swamp Workflow Management 2016-04-17 15:14:14 UTC
openSUSE-SU-2016:1081-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 973340
CVE References: CVE-2016-3186
Sources used:
openSUSE 13.2 (src):    tiff-4.0.6-10.23.1
Comment 7 Swamp Workflow Management 2016-04-19 17:20:08 UTC
openSUSE-SU-2016:1103-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 973340
CVE References: CVE-2016-3186
Sources used:
openSUSE 13.1 (src):    tiff-4.0.6-8.22.1
Comment 8 Swamp Workflow Management 2016-09-09 10:11:18 UTC
SUSE-SU-2016:2271-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 964225,973340,984808,984831,984837,984842,987351
CVE References: CVE-2015-8781,CVE-2015-8782,CVE-2015-8783,CVE-2016-3186,CVE-2016-5314,CVE-2016-5316,CVE-2016-5317,CVE-2016-5320,CVE-2016-5875
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    tiff-4.0.6-26.3
SUSE Linux Enterprise Server 12-SP1 (src):    tiff-4.0.6-26.3
SUSE Linux Enterprise Desktop 12-SP1 (src):    tiff-4.0.6-26.3
Comment 9 Swamp Workflow Management 2016-09-16 13:09:59 UTC
openSUSE-SU-2016:2321-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 964225,973340,984808,984831,984837,984842,987351
CVE References: CVE-2015-8781,CVE-2015-8782,CVE-2015-8783,CVE-2016-3186,CVE-2016-5314,CVE-2016-5316,CVE-2016-5317,CVE-2016-5320,CVE-2016-5875
Sources used:
openSUSE Leap 42.1 (src):    tiff-4.0.6-6.1
Comment 10 Marcus Meissner 2016-10-06 09:49:22 UTC
Created attachment 696137 [details]
CVE-2016-3186.gif

QA REPRODUCER:

gif2tiff CVE-2016-3186.gif foo.tiff
Comment 12 Swamp Workflow Management 2016-10-13 15:11:06 UTC
SUSE-SU-2016:2527-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 973340,974449,974614,974618,975069,984808,984831,984837,984842,987351
CVE References: CVE-2016-3186,CVE-2016-3622,CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-5314,CVE-2016-5316,CVE-2016-5317,CVE-2016-5320,CVE-2016-5875
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    tiff-3.8.2-141.168.1
SUSE Linux Enterprise Server 11-SP4 (src):    tiff-3.8.2-141.168.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    tiff-3.8.2-141.168.1