Browse code
BUG 2139746 [CVE-2018-10963] package : libtiff
Changes are done in spec file and added a patch.
Fix for assertion failure and application crash in libtiff-4.0.9 pkg.
Change-Id: I5347a3a9f8ffbda5badc1cda9c17a5bb867ea671
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5272
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Sharath George
Ankit Jain authored on 2018/06/19 23:19:18Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,18 @@ |
| 0 |
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c |
|
| 1 |
+index 2430de6d0c0dacf2cb3d228573972cc3ea3a153d..c15a28dbd8fcb99b81fa5a1d44fcbcda881f42a7 100644 |
|
| 2 |
+--- a/libtiff/tif_dirwrite.c |
|
| 3 |
+@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff) |
|
| 4 |
+ } |
|
| 5 |
+ break; |
|
| 6 |
+ default: |
|
| 7 |
+- assert(0); /* we should never get here */ |
|
| 8 |
+- break; |
|
| 9 |
++ TIFFErrorExt(tif->tif_clientdata,module, |
|
| 10 |
++ "Cannot write tag %d (%s)", |
|
| 11 |
++ TIFFFieldTag(o), |
|
| 12 |
++ o->field_name ? o->field_name : "unknown"); |
|
| 13 |
++ goto bad; |
|
| 14 |
+ } |
|
| 15 |
+ } |
|
| 16 |
+ } |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: TIFF libraries and associated utilities. |
| 2 | 2 |
Name: libtiff |
| 3 | 3 |
Version: 4.0.9 |
| 4 |
-Release: 5%{?dist}
|
|
| 4 |
+Release: 6%{?dist}
|
|
| 5 | 5 |
License: libtiff |
| 6 | 6 |
URL: http://www.simplesystems.org/libtiff/ |
| 7 | 7 |
Group: System Environment/Libraries |
| ... | ... |
@@ -18,6 +18,7 @@ Patch4: libtiff-4.0-9-CVE-2017-11613-1.patch |
| 18 | 18 |
Patch5: libtiff-4.0-9-CVE-2017-11613-2.patch |
| 19 | 19 |
Patch6: libtiff-4.0-9-CVE-2018-7456.patch |
| 20 | 20 |
Patch7: libtiff-4.0.9-CVE-2018-8905.patch |
| 21 |
+Patch8: libtiff-4.0.9-CVE-2018-10963.patch |
|
| 21 | 22 |
|
| 22 | 23 |
BuildRequires: libjpeg-turbo-devel |
| 23 | 24 |
Requires: libjpeg-turbo |
| ... | ... |
@@ -41,6 +42,7 @@ It contains the libraries and header files to create applications |
| 41 | 41 |
%patch5 -p1 |
| 42 | 42 |
%patch6 -p1 |
| 43 | 43 |
%patch7 -p1 |
| 44 |
+%patch8 -p1 |
|
| 44 | 45 |
%build |
| 45 | 46 |
%configure \ |
| 46 | 47 |
--disable-static |
| ... | ... |
@@ -74,6 +76,8 @@ make %{?_smp_mflags} -k check
|
| 74 | 74 |
%{_datadir}/man/man3/*
|
| 75 | 75 |
|
| 76 | 76 |
%changelog |
| 77 |
+* Tue Jun 19 2018 Ankit Jain <ankitja@vmware.com> 4.0.9-6 |
|
| 78 |
+- Fix CVE-2018-10963 |
|
| 77 | 79 |
* Mon May 14 2018 Xiaolin Li <xiaolinl@vmware.com> 4.0.9-5 |
| 78 | 80 |
- Fix CVE-2018-7456, CVE-2018-8905 |
| 79 | 81 |
* Fri Apr 20 2018 Xiaolin Li <xiaolinl@vmware.com> 4.0.9-4 |