镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com

Repository navigation

Question regarding CVE-2019-16865 #4123

Closed

Labels

opened

Hi,
I am looking at CVE-2019-16865 [0] reported as fixed with the new 6.2 release, but the information about it is quite limited and I could not find a specific mention in git log. In addition the Changelog does not seem to mention anything specifically security related.

Would it be possible to elaborate a bit about the issue and maybe point to a commit fixing the issue ?

Thanks in advance!

[0] https://nvd.nist.gov/vuln/detail/CVE-2019-16865

hugovk commented on Oct 7, 2019
hugovk
on Oct 7, 2019
Member
Hi, it's the changes from these PRs:

Corrected negative seeks #4101 "Corrected negative seeks"

Added decompression bomb checks #4102 "Added decompression bomb checks"

Raise error if TIFF dimension is a string #4103 "Catch buffer overruns"

Catch buffer overruns #4104 "Raise error if TIFF dimension is a string"

Reacted by flyfire and Riccardo Schirone
rfrohl commented on Oct 7, 2019
rfrohl
on Oct 7, 2019
Author
@hugovk Thanks for the quick answer!
Reacted by Hugo van Kemenade and flyfire
rfrohl
closed this as completed on Oct 7, 2019
radarhere
added
Question
on Oct 7, 2019

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests