PT-2016-4578 · Libtiff+2 · Libtiff+2

Even Rouault · Published 2016-12-31 · Updated 2018-12-23 · CVE-2016-10094

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.0.7

Description The issue is caused by an off-by-one error in the t2p readwrite pdf image tile function in tools/tiff2pdf.c. This error allows remote attackers to have an unspecified impact via a crafted image.

Recommendations For LibTIFF version 4.0.7, consider disabling the t2p readwrite pdf image tile function until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2016-10094

DSA-3762-1

MGASA-2017-0199

OPENSUSE-SU-2018_4053-1

OPENSUSE-SU-2018_4256-1

SUSE-SU-2018:4008-1

SUSE-SU-2018:4120-1

SUSE-SU-2018:4191-1

USN-3212-1

USN-3212-2

Affected Products

Libtiff

Suse

Ubuntu

References · 77

• 🔥 https://github.com/vadz/libtiff/commit/c7153361a4041260719b340f73f2f76 · Exploit
• 🔥 http://bugzilla.maptools.org/show_bug.cgi?id=2640 · Exploit
• https://ubuntu.com/security/CVE-2016-3623 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9538 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10094 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0199.html · Security Note
• https://ubuntu.com/security/CVE-2016-9297 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9273 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8331 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9533 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4008-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6223 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5315 · Vendor Advisory