[Secure-testing-commits] r39144 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2016-01-24 15:25:42 +0000 (Sun, 24 Jan 2016)
New Revision: 39144

Modified:
   data/CVE/list
Log:
Clarify description for one tiff issue

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2016-01-24 14:07:01 UTC (rev 39143)
+++ data/CVE/list	2016-01-24 15:25:42 UTC (rev 39144)
@@ -5,9 +5,11 @@
 CVE-2015-XXXX [Out-of-bounds write for invalid images using LogL compression]
 	- tiff 4.0.6-1
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2522
-CVE-2015-XXXX [uninitialized memory in NeXTDecode]
+CVE-2015-XXXX [potential out-of-bound write in NeXTDecode()]
 	- tiff 4.0.6-1
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2508
+	NOTE: Can be reproduced with tiff compiled with AddressSanitizer
+	NOTE: and the same reproducer file http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
 CVE-2015-XXXX [insecure use of temporary files]
 	- node-cli <unfixed> (bug #809252)
 	[jessie] - node-cli <no-dsa> (Minor issue)