Bug 1021652 (CVE-2017-5563) - VUL-1: CVE-2017-5563: tiff: LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read intif_lzw.c resulting in DoS o...
Summary: VUL-1: CVE-2017-5563: tiff: LibTIFF version 4.0.7 is vulnerable to a heap-bas...
Status: RESOLVED WORKSFORME
Alias: CVE-2017-5563
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Fridrich Strba
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/179006/
Whiteboard: CVSSv2:NVD:CVE-2017-5563:6.8:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-01-24 13:10 UTC by Matthias Gerstner
Modified: 2017-03-29 09:22 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2017-01-24 13:10:12 UTC 
Found by wang junjie

CVE-2017-5563

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in
tif_lzw.c resulting in DoS or code execution via a crafted bmp image to
tools/bmp2tiff.

Upstream bug report:

http://bugzilla.maptools.org/show_bug.cgi?id=2664

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5563
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5563.html
http://www.cvedetails.com/cve/CVE-2017-5563/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5563
http://bugzilla.maptools.org/show_bug.cgi?id=2664
Comment 1 Matthias Gerstner 2017-01-24 13:19:47 UTC 
There's a PoC file in the upstream bug:

http://bugzilla.maptools.org/attachment.cgi?id=749&action=edit

It's supposed to trigger using `bmp2tiff`:

  bmp2tiff -c lzw poc out.tif

Doing so shows no visible sign of corruption, valgrind reports no errors. The
issue probably only can be reproduced using a build with '-fsanitize=address'.

It seems there's no upstream patch available yet.

Need to postpone analysis until the patch is available.
Comment 2 Swamp Workflow Management 2017-01-24 23:01:38 UTC 
bugbot adjusting priority
Comment 6 Fridrich Strba 2017-03-29 09:22:12 UTC 
Works for us