2008.08.31 15:38 "Re: [Tiff] Some security fixes from RHEL", by Bob Friesenhahn

Honestly, I think libtiff has lots of security issues in the fact of hostile TIFF files, and I find it hard to get excited about any particular issue.

I do agree that libtiff maintenance has not historically been in knee-jerk synchronized response to reports of security exploits. Probably there has never been a release due to a security exploit. Libtiff releases are few and far between and occur due to the actions of an interested maintainer.

It is not particularly difficult to find TIFF files which could crash libtiff. If 'tiffinfo' crashes, then it is likely that a program using libtiff will also crash.

Coverity shows that libtiff has been riddled with issues. There are likely many more complex issues that Coverity would not spot.

If an application needs to be secure/stable in the face of hostile files then it should not link against libtiff.

Bob
======================================
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/