en Copyright 2015 Java http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#884f9736 * libtiff 4.0.7 released.* configure.ac: Update for 4.0.7 release. List of files: /libtiff-4.0.7/ChangeLog Sat, 19 Nov 2016 17:47:39 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#07e63bcd * tools/tiffdump.c (ReadDirectory): Remove uint32 cast to_TIFFmalloc() argument which resulted in Coverity report. Addedmore mutiplication overflow checks. List of files: /libtiff-4.0.7/ChangeLog Sat, 19 Nov 2016 15:42:46 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#1aa4ee54 Assign CVE numbers List of files: /libtiff-4.0.7/ChangeLog Sat, 19 Nov 2016 10:33:19 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#c80c06ce * tools/tiffcrop.c: Fix memory leak in (recent) error code path.Fixes Coverity 1394415. List of files: /libtiff-4.0.7/ChangeLog Fri, 18 Nov 2016 14:58:46 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#ca5b774b * libtiff/tif_getimage.c: Fix some benign warnings which appear in64-bit compilation under Microsoft Visual Studio of the form"Arithmetic overflow: 32-bit value is shifted, then cast to 64-bitvalue. Results might not be an expected value.". Problem wasreported on November 16, 2016 on the tiff mailing list. List of files: /libtiff-4.0.7/ChangeLog Fri, 18 Nov 2016 02:47:45 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#6d055b4f * libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not dereferenceNULL pointer when values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCIIaccess are 0-byte arrays.Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression introducedby previous fix done on 2016-11-11 for CVE-2016-9297).Reported by Henri Salo. List of files: /libtiff-4.0.7/ChangeLog Wed, 16 Nov 2016 15:14:15 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#5936de5b Assign CVE-2016-9297 number List of files: /libtiff-4.0.7/ChangeLog Mon, 14 Nov 2016 19:08:24 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#c22e3e5b * tools/tiffinfo.c (TIFFReadContigTileData): Fix signed/unsignedcomparison warning.(TIFFReadSeparateTileData): Fix signed/unsigned comparisonwarning. List of files: /libtiff-4.0.7/ChangeLog Sat, 12 Nov 2016 20:06:05 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#d2c7f195 * tools/tiffcrop.c (readContigTilesIntoBuffer): Fixsigned/unsigned comparison warning. List of files: /libtiff-4.0.7/ChangeLog Sat, 12 Nov 2016 18:35:11 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#35b7f035 * html/v4.0.7.html: Add a file to document the pending 4.0.7release. List of files: /libtiff-4.0.7/ChangeLog Sat, 12 Nov 2016 18:30:47 +0000 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#57b0f8ba * tools/tiff2pdf.c: avoid undefined behaviour related to overlappingof source and destination buffer in memcpy() call int2p_sample_rgbaa_to_rgb()Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2577 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 21:22:50 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#16e71ae0 * tools/tiff2pdf.c: fix potential integer overflows on 32 bit buildsin t2p_read_tiff_size()Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2576 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 21:15:25 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#1a64e2cc Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 (CVE-2016-9273) List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 21:09:07 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#56f3e29d * libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted()when requesting Predictor tag and that the zip/lzw codec is notconfigured.Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 20:45:53 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#9bddab50 * libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure thatvalues of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCIIaccess are null terminated, to avoid potential read outside bufferin _TIFFPrintField().Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 20:22:01 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#1120426b * libtiff/tif_dirread.c: reject images with OJPEG compression thathave no TileOffsets/StripOffsets tag, when OJPEG compression isdisabled. Prevent null pointer dereference in TIFFReadRawStrip1()and other functions that expect td_stripbytecount to be non NULL.Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 20:01:55 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#49062afa * tools/tiffcrop.c: fix multiple uint32 overflows inwriteBufferToSeparateStrips(), writeBufferToContigTiles() andwriteBufferToSeparateTiles() that could cause heap buffer overflows.Reported by Henri Salo from Nixu Corporation.Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2592 List of files: /libtiff-4.0.7/ChangeLog Fri, 11 Nov 2016 19:33:06 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#a7abf0ba * libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstripsvalue when it is non-zero, instead of recomputing it. This is needed inTIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize ofarray in tiffsplit (or other utilities using TIFFNumberOfStrips()).Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587 List of files: /libtiff-4.0.7/ChangeLog Wed, 09 Nov 2016 23:00:49 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#3f5f68e9 * libtiff/tif_predic.c: fix memory leaks in error code paths added inprevious commit (fix for MSVR 35105) List of files: /libtiff-4.0.7/ChangeLog Fri, 04 Nov 2016 09:19:13 +0000 Even Rouault <even.rouault@spatialys.com> http://172.16.0.5:8080/history/libtiff-4.0.7/ChangeLog#a41c294c * libtiff/tif_predict.h, libtiff/tif_predict.c:Replace assertions by runtime checks to avoid assertions in debug mode,or buffer overflows in release mode. Can happen when dealing withunusual tile size like YCbCr with subsampling. Reported as MSVR 35105by Axel Souchet & Vishal Chauhan from the MSRC Vulnerabilities & Mitigationsteam. List of files: /libtiff-4.0.7/ChangeLog Mon, 31 Oct 2016 17:24:26 +0000 Even Rouault <even.rouault@spatialys.com>