From 1aa6993d5e03254c5bb397efdcb63df5354c4592 Mon Sep 17 00:00:00 2001 From: plouj Date: Mon, 13 Jul 2009 23:09:30 +0000 Subject: [PATCH] - update upstream URL - Fix some more LZW decoding vulnerabilities (CVE-2009-2285) Related: #511015 --- libtiff-3.8.2-lzw-bugs.patch | 6 +++--- mingw32-libtiff.spec | 9 +++++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/libtiff-3.8.2-lzw-bugs.patch b/libtiff-3.8.2-lzw-bugs.patch index 874e5e3..a0d46f2 100644 --- a/libtiff-3.8.2-lzw-bugs.patch +++ b/libtiff-3.8.2-lzw-bugs.patch @@ -1,4 +1,4 @@ -Fixes for CVE-2008-2327 +Fixes for CVE-2008-2327 and CVE-2009-2285 diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c @@ -27,7 +27,7 @@ diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c NextCode(tif, sp, bp, code, GetNextCode); if (code == CODE_EOI) break; -+ if (code == CODE_CLEAR) { ++ if (code >= CODE_CLEAR) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "LZWDecode: Corrupted LZW table at scanline %d", + tif->tif_row); @@ -47,7 +47,7 @@ diff -Naur tiff-3.8.2.orig/libtiff/tif_lzw.c tiff-3.8.2/libtiff/tif_lzw.c NextCode(tif, sp, bp, code, GetNextCodeCompat); if (code == CODE_EOI) break; -+ if (code == CODE_CLEAR) { ++ if (code >= CODE_CLEAR) { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "LZWDecodeCompat: Corrupted LZW table at scanline %d", + tif->tif_row); diff --git a/mingw32-libtiff.spec b/mingw32-libtiff.spec index 4a75cdc..c5f4846 100644 --- a/mingw32-libtiff.spec +++ b/mingw32-libtiff.spec @@ -7,10 +7,10 @@ Summary: MinGW Windows port of the LibTIFF library Name: mingw32-libtiff Version: 3.8.2 -Release: 16%{?dist} +Release: 17%{?dist} License: libtiff Group: System Environment/Libraries -URL: http://www.libtiff.org/ +URL: http://www.remotesensing.org/libtiff/ Source: ftp://ftp.remotesensing.org/pub/libtiff/tiff-%{version}.tar.gz Patch0: tiffsplit-overflow.patch @@ -77,6 +77,11 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Mon Jul 13 2009 Michael Ploujnikov - 3.8.2-17 +- update upstream URL +- Fix some more LZW decoding vulnerabilities (CVE-2009-2285) +Related: #511015 + * Mon Jun 8 2009 Michael Ploujnikov - 3.8.2-16 - add mingw32-gcc-c++ to the BuildRequirements