diff options
author | Armin Kuster <akuster808@gmail.com> | 2016-12-10 09:38:43 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-01-11 17:21:45 +0000 |
commit | baf73313b3f63537853278992fa7c00775a6eff4 (patch) | |
tree | d5983f67c33f88b81df914f0cfbf5883d4de4877 /meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch | |
parent | 985beaaa1309a97d42aa0f886096db041060a95e (diff) | |
download | poky-baf73313b3f63537853278992fa7c00775a6eff4.tar.gz |
libtiff: Update to 4.0.7
Major changes:
The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed from the distribution, used for demos.
CVEs fixed:
CVE-2016-9297
CVE-2016-9448
CVE-2016-9273
CVE-2014-8127
CVE-2016-3658
CVE-2016-5875
CVE-2016-5652
CVE-2016-3632
plus more that are not identified in the changelog.
removed patches integrated into update.
more info: http://libtiff.maptools.org/v4.0.7.html
(From OE-Core rev: 9945cbccc4c737c84ad441773061acbf90c7baed)
(From OE-Core rev: 009b330591b27bd14d4c8ceb767c78fd7eb924fd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch')
-rw-r--r-- | meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch b/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch deleted file mode 100644 index a8392509e6..0000000000 --- a/meta/recipes-multimedia/libtiff/files/CVE-2016-3632.patch +++ /dev/null | |||
@@ -1,34 +0,0 @@ | |||
1 | From d3f9829a37661749b200760ad6525f77cf77d77a Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com> | ||
3 | Date: Mon, 11 Jul 2016 16:04:34 +0200 | ||
4 | Subject: [PATCH 4/8] Fix CVE-2016-3632 | ||
5 | |||
6 | CVE-2016-3632 libtiff: The _TIFFVGetField function in tif_dirinfo.c in | ||
7 | LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service | ||
8 | (out-of-bounds write) or execute arbitrary code via a crafted TIFF image. | ||
9 | |||
10 | CVE: CVE-2016-3632 | ||
11 | Upstream-Status: Backport [RedHat RHEL7] | ||
12 | |||
13 | Signed-off-by: Yi Zhao <yi.zhao@windirver.com> | ||
14 | --- | ||
15 | tools/thumbnail.c | 3 ++- | ||
16 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
17 | |||
18 | diff --git a/tools/thumbnail.c b/tools/thumbnail.c | ||
19 | index fd1cba5..75e7009 100644 | ||
20 | --- a/tools/thumbnail.c | ||
21 | +++ b/tools/thumbnail.c | ||
22 | @@ -253,7 +253,8 @@ static struct cpTag { | ||
23 | { TIFFTAG_WHITEPOINT, 2, TIFF_RATIONAL }, | ||
24 | { TIFFTAG_PRIMARYCHROMATICITIES, (uint16) -1,TIFF_RATIONAL }, | ||
25 | { TIFFTAG_HALFTONEHINTS, 2, TIFF_SHORT }, | ||
26 | - { TIFFTAG_BADFAXLINES, 1, TIFF_LONG }, | ||
27 | + // disable BADFAXLINES, CVE-2016-3632 | ||
28 | + //{ TIFFTAG_BADFAXLINES, 1, TIFF_LONG }, | ||
29 | { TIFFTAG_CLEANFAXDATA, 1, TIFF_SHORT }, | ||
30 | { TIFFTAG_CONSECUTIVEBADFAXLINES, 1, TIFF_LONG }, | ||
31 | { TIFFTAG_INKSET, 1, TIFF_SHORT }, | ||
32 | -- | ||
33 | 2.7.4 | ||
34 | |||