2008.09.02 08:24 "Re: [Tiff] Some security fixes from RHEL", by Tom Lane

[ separate reply for a separate issue ]

As maintainer of Red Hat's libtiff package, I am now seriously wondering whether I must recommend that Red Hat disable TIFF support in any application that has any internet exposure.

There is not really any reason to single libtiff out. You can insert many application/library names here.

No, not really. Image processing libraries have a particularly bad name amongst the security community. I suppose that this isn't so much because their code was any worse than anyone else's, as that it's been an easy attack vector for both email and http hackers. Most web browsers and email clients will happily try to load any file that is presented to them as being an image. If they rely on an image library that is vulnerable, then it's game over. And do you really think it's the browser's responsibility to check the image before feeding it to libtiff?

Whether you like this responsibility or not, you have to accept it, or else you'll just be a footnote to history.

regards, tom lane