PT-2016-2787 · Libtiff+1 · Libtiff+1

Kaixiang Zhang · Published 2016-10-03 · Updated 2019-04-10 · CVE-2016-3633

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions 4.0.6 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically an out-of-bounds read, via vectors related to the src variable. This is related to the setrow function in the thumbnail tool.

Recommendations For LibTIFF versions 4.0.6 and earlier, consider restricting access to the thumbnail tool until a patch is available. As a temporary workaround, avoid using the setrow function in the thumbnail tool to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1628

BDU:2016-02190

CVE-2016-3633

DLA-693-1

Affected Products

Alt Linux

Libtiff

References · 107

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3624 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14973 · Security Note
• https://bdu.fstec.ru/vul/2016-00539 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Security Note
• https://bdu.fstec.ru/vul/2017-00883 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960 · Security Note
• https://bdu.fstec.ru/vul/2017-00330 · Security Note
• https://bdu.fstec.ru/vul/2015-06340 · Security Note
• https://bdu.fstec.ru/vul/2016-02190 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4243 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5360 · Security Note