PT-2016-4576 · None+2 · Libtiff+2

Agostino Sarubbo · Published 2016-12-31 · Updated 2024-06-15 · CVE-2016-10092

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF versions 3.9.3 through 4.0.6

Description The issue is related to a heap-based buffer overflow in the readContigStripsIntoBuffer function in tif unix.c. This allows remote attackers to have an unspecified impact via a crafted image.

Recommendations For LibTIFF versions 3.9.3 through 4.0.6, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-10092

DLA-795-1

DSA-3762-1

MGASA-2017-0199

OPENSUSE-SU-2018_4053-1

OPENSUSE-SU-2018_4256-1

OPENSUSE-SU-2024:13381-1

SUSE-SU-2018:4008-1

SUSE-SU-2018:4120-1

SUSE-SU-2018:4191-1

SUSE-SU-2018_4008-1

SUSE-SU-2018_4120-1

SUSE-SU-2018_4191-1

USN-3212-1

USN-3212-2

USN-3212-3

Affected Products

Libtiff

Suse

Ubuntu

References · 94

• 🔥 https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2016-10092 · Exploit
• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2622 · Exploit
• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2620 · Exploit
• https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0ba6a · Patch
• https://cve.org/CVERecord?id=CVE-2016-10092 · Security Note
• https://ubuntu.com/security/CVE-2016-3623 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9538 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0199.html · Security Note
• https://ubuntu.com/security/CVE-2016-9297 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3212-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9273 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8331 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4008-1 · Vendor Advisory