linux/poky.git/meta/recipes-multimedia/libtiff/files, branch python3

tiff: Security fixes CVE-2015-8665 and CVE-2015-8683

2016-04-29T06:41:43+00:00

same fix for both CVE's tiff <= 4.0.6 (From OE-Core rev: b7a38a45bf404b8f9b419bf7c054102d68cf2673) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tiff: Update to 4.0.4

2015-06-27T21:42:56+00:00

Update tiff to latest version. None of the local CVE patches are needed based on reviewing the ChangeLog so remove them. (From OE-Core rev: 5c5d7c2ab0d32faca43ba360d5d42ecd2822c730) Signed-off-by: Randy MacLeod Signed-off-by: Richard Purdie

libtiff: fix CVE-2013-1961

2014-08-27T11:12:32+00:00

Integrate community fix for the issue CVE-2013-1961 and migrated to version 4.0.3. Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file. (From OE-Core rev: f24e3456c60951d2985d7c23bdcc1f8c15d6c167) Signed-off-by: Priyanka Shobhan Signed-off-by: Christopher Larson Signed-off-by: Muzaffar Mahmood Signed-off-by: Richard Purdie

libtiff: Security Advisory - CVE-2012-4564

2014-06-17T09:23:53+00:00

v2 changes: * update format for commit log * add Upstream-Status for patch ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4564 (From OE-Core rev: 9f02922d44de483ef4d02ce95b55efe79a8b09a2) Signed-off-by: Yue Tao Signed-off-by: Wenzong Fan Signed-off-by: Richard Purdie

tiff: fix for Security Advisory CVE-2013-4231

2014-05-21T08:09:01+00:00

Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4231Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4231 (From OE-Core rev: 19e6d05161ef9f4e5f7277f6eb35eb5d94ecf629) Signed-off-by: Yue Tao Signed-off-by: Roy Li Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

libtiff: fix CVE-2013-4244

2014-03-30T09:10:32+00:00

cve description: The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4244 (From OE-Core rev: 4eec8fae3f972a27bfb986066f5b3603599ebc25) Signed-off-by: Baogen Shang Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libtiff: CVE-2013-4243

2013-12-10T17:42:45+00:00

cve description: Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4243 (From OE-Core rev: 47388363f69bfbf5ed1816a9367627182ee10e88) Signed-off-by: Baogen Shang Signed-off-by: Robert Yang Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie

libtiff: CVE-2013-4232

2013-12-10T17:42:44+00:00

cve description: Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted TIFF image. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4232 (From OE-Core rev: bd4a878815e7033b1114940e2a5a16568322655b) Signed-off-by: Baogen Shang Signed-off-by: Robert Yang Signed-off-by: Mark Hatle Signed-off-by: Richard Purdie

libtiff: fix CVE-2013-1960

2013-12-10T17:42:44+00:00

Heap-based buffer overflow in the tp_process_jpeg_strip function in tiff2pdf in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image file. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1960 (From OE-Core rev: 9db7a897d216a8293152c1a3b96c72b699d469c7) Signed-off-by: Ming Liu Signed-off-by: Jeff Polk Signed-off-by: Richard Purdie

libtiff: Update to 3.9.5

2011-10-14T12:18:17+00:00

(From OE-Core rev: 7a6218b05eb4ec23e6378a1738ac2f6809fe5c08) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie