[Secure-testing-commits] r47981 - data/CVE

Moritz Muehlenhoff jmm at moszumanska.debian.org
Fri Jan 13 15:53:19 UTC 2017


Author: jmm
Date: 2017-01-13 15:53:19 +0000 (Fri, 13 Jan 2017)
New Revision: 47981

Modified:
   data/CVE/list
Log:
record fixed versions for tools dropped in jessie
 - technically still somewhat present in the source, but mark as fixed anyway


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2017-01-13 15:34:09 UTC (rev 47980)
+++ data/CVE/list	2017-01-13 15:53:19 UTC (rev 47981)
@@ -16196,9 +16196,10 @@
 	{DLA-693-1}
 	- tiff 4.0.6-3
 	- tiff3 <removed>
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
 	NOTE: http://www.talosintelligence.com/reports/TALOS-2016-0190/
-	NOTE: thumbnail(1) removed in 4.0.6-3
+	NOTE: thumbnail(1) was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 	NOTE: From the backtrace shared in the report, we can see that the crash is triggered though the thumbnail tool which has been dropped upstream.
 CVE-2016-8330
 	RESERVED
@@ -26647,12 +26648,13 @@
 	{DLA-693-1}
 	- tiff <unfixed> (bug #842046)
 	- tiff3 <removed>
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	[wheezy] - tiff3 <not-affected> (tools like bmp2tiff not shipped by tiff3 source package)
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2562
 	NOTE: Reproducer http://bugzilla.maptools.org/attachment.cgi?id=652
 	NOTE: Utility bmp2tiff has been removed from upstream LibTIFF
 	NOTE: No patch available. Marked as wontfix by upstream.
-	NOTE: bmp2tiff was removed in 4.0.6-3, but the affected function is still present
+	NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-5318 [libtiff: stack buffer overflow in _TIFFVGetField function]
 	RESERVED
 	{DLA-693-1 DLA-692-1}
@@ -27605,7 +27607,7 @@
 	RESERVED
 	{DLA-693-1}
 	- tiff 4.0.6-3
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff-tools)
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2552
@@ -27614,7 +27616,7 @@
 	NOTE: Upstream will remove gif2tiff from 4.0.7 release
 	NOTE: No patch available. Marked as wontfix by upstream
 	NOTE: Reproducer http://bugs.fi/media/afl/libtiff/CVE-2016-5102.gif
-	NOTE: gif2tiff removed in 4.0.6-3
+	NOTE: gif2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-5101 (Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows ...)
 	NOT-FOR-US: Opera
 CVE-2016-5100
@@ -31996,45 +31998,45 @@
 CVE-2016-3634 (The tagCompare function in tif_dirinfo.c in the thumbnail tool in ...)
 	{DLA-693-1}
 	- tiff <unfixed>
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
 	NOTE: src:tiff3: built binary packages do not contain the TIFF tools
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2547
 	NOTE: Upstream will remove thumbnail from 4.0.7 release
 	NOTE: No patch available. Issue marked as wontfix by upstream.
-	NOTE: thumbnail(1) removed in 4.0.6-3, but vulnerable library code still present
+	NOTE: thumbnail(1) was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3633 (The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier ...)
 	{DLA-693-1}
 	- tiff 4.0.6-3 (bug #842046)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
 	NOTE: src:tiff3: built binary packages do not contain the TIFF tools
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2548
 	NOTE: Upstream will remove thumbnail from 4.0.7 release
 	NOTE: No patch available. Issue marked as wontfix by upstream.
-	NOTE: thumbnail(1) removed in 4.0.6-3
+	NOTE: thumbnail(1) was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3632 (The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and ...)
 	{DLA-693-1}
 	- tiff <unfixed>
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
 	NOTE: src:tiff3: built binary packages do not contain the TIFF tools
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2549
 	NOTE: Upstream will remove thumbnail from 4.0.7 release
 	NOTE: No patch available. Issue marked as wontfix by upstream.
-	NOTE: thumbnail(1) removed in 4.0.6-3, but vulnerable library code still present
+	NOTE: thumbnail(1) was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3631 (The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in ...)
 	{DLA-693-1}
 	- tiff 4.0.6-3 (bug #820366)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
 	NOTE: src:tiff3: built binary packages do not contain the TIFF tools
 	NOTE: No patch available. Issue marked as wontfix by upstream.
-	NOTE: thumbnail(1) removed in 4.0.6-3
+	NOTE: thumbnail(1) was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3630 (The binary delta decoder in Mercurial before 3.7.3 allows remote ...)
 	{DSA-3542-1}
 	- mercurial 3.7.3-1 (bug #819504)
@@ -32077,30 +32079,30 @@
 CVE-2016-3621 (The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF ...)
 	{DLA-693-1}
 	- tiff <unfixed> (low; bug #820364)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <not-affected> (tiff tools not built)
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2565
 	NOTE: http://www.openwall.com/lists/oss-security/2016/04/07/3
 	NOTE: Utility bmp2tiff has been removed from upstream LibTIFF
-	NOTE: bmp2tiff was removed in 4.0.6-3, but the affected function is still present
+	NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3620 (The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF ...)
 	{DLA-693-1}
 	- tiff <unfixed> (low; bug #820363)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <not-affected> (tiff tools not built)
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2570
 	NOTE: http://www.openwall.com/lists/oss-security/2016/04/07/2
 	NOTE: Utility bmp2tiff has been removed from upstream LibTIFF
-	NOTE: bmp2tiff was removed in 4.0.6-3, but the affected function is still present
+	NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3619 (The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in ...)
 	{DLA-693-1}
 	- tiff <unfixed> (low; bug #820362)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <not-affected> (tiff tools not built)
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2567
 	NOTE: http://www.openwall.com/lists/oss-security/2016/04/07/1
 	NOTE: Utility bmp2tiff has been removed from upstream LibTIFF
-	NOTE: bmp2tiff was removed in 4.0.6-3, but the affected function is still present
+	NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3618
 	RESERVED
 CVE-2016-3617
@@ -33090,13 +33092,13 @@
 CVE-2016-3186 (Buffer overflow in the readextension function in gif2tiff.c in LibTIFF ...)
 	{DLA-693-1 DLA-610-1}
 	- tiff 4.0.6-3 (bug #819972)
-	[jessie] - tiff <no-dsa> (Minor issue)
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff3 <removed> (unimportant)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1319666
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1319503
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2536
 	NOTE: Proposed patch from Red Hat: https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff
-	NOTE: gif2tiff removed in 4.6.0-3
+	NOTE: gif2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2016-3185 (The make_http_soap_request function in ext/soap/php_http.c in PHP ...)
 	- php7.0 7.0.4-1
 	NOTE: https://bugs.php.net/bug.php?id=71610
@@ -40653,6 +40655,7 @@
 	NOTE: non-issue for Debian-packaged version
 CVE-2015-8668 (Heap-based buffer overflow in the PackBitsPreEncode function in ...)
 	{DLA-693-1}
+	[jessie] - tiff 4.0.3-12.3+deb8u2
 	- tiff 4.0.6-3 (bug #842046)
 	- tiff3 <removed>
 	[wheezy] - tiff3 <not-affected> (Does not ship libtiff tools)
@@ -40662,7 +40665,7 @@
 	NOTE: Issue was also marked as wontfix, because bmp2tiff utility has been removed
 	NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2563#c4
 	NOTE: Reproducer file here: http://bugzilla.maptools.org/attachment.cgi?id=677
-	NOTE: bmp2tiff was removed in 4.0.6-3
+	NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed although technically still present in the source package
 CVE-2015-8683 (The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 ...)
 	{DSA-3467-1 DLA-610-1 DLA-402-1}
 	- tiff 4.0.6-1 (bug #809021)




More information about the Secure-testing-commits mailing list