LibTiff Mailing List
TIFF and LibTiff Mailing List Archive
August 2008
Previous Thread
Next Thread
Previous by Thread
Next by Thread
Previous by Date
Next by Date
Contact
The TIFF Mailing List Homepage
This list is run by Frank Warmerdam
Archive maintained by AWare Systems
Thread
2008.08.31 15:38 "Re: Some security fixes from RHEL", by Bob Friesenhahn
On Sun, 31 Aug 2008, Frank Warmerdam wrote: > > Honestly, I think libtiff has lots of security issues in the fact of hostile > TIFF files, and I find it hard to get excited about any particular issue. I do agree that libtiff maintenance has not historically been in knee-jerk synchronized response to reports of security exploits. Probably there has never been a release due to a security exploit. Libtiff releases are few and far between and occur due to the actions of an interested maintainer. It is not particularly difficult to find TIFF files which could crash libtiff. If 'tiffinfo' crashes, then it is likely that a program using libtiff will also crash. Coverity shows that libtiff has been riddled with issues. There are likely many more complex issues that Coverity would not spot. If an application needs to be secure/stable in the face of hostile files then it should not link against libtiff. Bob ====================================== Bob Friesenhahn bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/