[BUG][UNIX]

[mariamarutunian]

Summary

A vulnerability identified as CVE-2013-4244 was discovered and fixed in libtiff. However, related file isn't updated in the POV-Ray project.

POV-Ray Version

• Affected build version: < 3.7.0.10

Details
It was fixed on libtiff with the following commit: vadz/libtiff@ce6841d which amended 'process' function in tools/gif2tiff.c file.
The POV-Ray project contains an identical 'process' function in libraries/tiff/tools/gif2tiff.c file, which has not been updated.

References

• https://security-tracker.debian.org/tracker/CVE-2013-4244
• vadz/libtiff@ce6841d

Report Origin
The bug is reported by a tool developed at CAST.