PT-2016-2789 · Libtiff+1 · Libtiff+1

Mei Wang · Published 2016-10-03 · Updated 2019-04-10 · CVE-2016-3625

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions 4.0.6 and earlier

Description The issue allows a remote attacker to cause a denial of service via a crafted TIFF image. This is due to an out-of-bounds read in the tif read.c file of the tiff2bw tool in LibTIFF.

Recommendations For LibTIFF versions 4.0.6 and earlier, consider disabling the tiff2bw tool until a patch is available to prevent potential denial of service attacks. Restrict access to the tif read.c function to minimize the risk of exploitation. Avoid using the tiff2bw tool with untrusted TIFF images until the issue is resolved.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1628

BDU:2016-02192

CVE-2016-3625

Affected Products

Alt Linux

Libtiff

References · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3624 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14973 · Security Note
• https://bdu.fstec.ru/vul/2016-00539 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3625 · Security Note
• https://bdu.fstec.ru/vul/2017-00883 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960 · Security Note
• https://bdu.fstec.ru/vul/2017-00330 · Security Note
• https://bdu.fstec.ru/vul/2015-06340 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3625 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02190 · Security Note