2008.08.31 21:09 "Re: [Tiff] Some security fixes from RHEL", by Rogier Wolff

On Sun, Aug 31, 2008 at 10:38:01AM -0500, Bob Friesenhahn wrote:

If an application needs to be secure/stable in the face of hostile files then it should not link against libtiff.

I would like to be able to view tiff files. Maybe some NASA site (*) has "tiff" as the "higher quality" images.

My image viewer of choice is: gqview. But you're saying that because it's linked against libtiff, I shouldn't be using it.

Or that because gqview might be run on files from the internet, gqview should not link against libtiff.

So, because I might download an image from the internet, and try to modify it using the gimp, GIMP should not link against libtiff.

Because Imagemagick might be used to convert an image from the internet, imagemagick should not link against libtiff.

Hylafax is used on tiff files recieved from fax machines on the other end. Some malicious user might send invalid tiff files.

My system lists 199 packages as depending on libtiff. Over half cannot guarantee that they won't be run on data from the internet.

For the record, I find your statement rediculous.

        Roger.

(*) You'd say that I could "trust" the NASA. However, nasa delivers the TIFF files unencrypted, so they might be modified en-route, or with for example the recent DNS exploit, I might be browsing a hacked-side pretending to be NASA.

--

** R.E.Wolff@BitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2600998 **
**    Delftechpark 26 2628 XH  Delft, The Netherlands. KVK: 27239233    **

*-- BitWizard writes Linux device drivers for any device you may have! --*
Q: It doesn't work. A: Look buddy, doesn't work is an ambiguous statement.
Does it sit on the couch all day? Is it unemployed? Please be specific!
Define 'it' and what it isn't doing. --------- Adapted from lxrbot FAQ