PT-2017-8696 · Libtiff+3 · Libtiff+3

Andrej Nemec · Published 2017-02-06 · Updated 2019-11-25 · CVE-2016-5102

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.0.6

Description The issue is related to a buffer overflow in the readgifimage function in gif2tiff.c within the gif2tiff tool. This can be exploited by remote attackers using a crafted gif file, leading to a denial of service in the form of a segmentation fault.

Recommendations For LibTIFF version 4.0.6, consider updating to a newer version that addresses this issue, as the current version is affected by the buffer overflow in the readgifimage function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1628

CVE-2016-5102

DLA-693-1

SUSE-SU-2019:14002-1

SUSE-SU-2019:3058-1

SUSE-SU-2019_14002-1

SUSE-SU-2019_3058-1

USN-3606-1

Affected Products

Alt Linux

Libtiff

Suse

Ubuntu

References · 168

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8129 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3634 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00539 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1961 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9330 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3186 · Security Note
• https://bdu.fstec.ru/vul/2017-00883 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1960 · Security Note
• https://bdu.fstec.ru/vul/2017-00330 · Security Note
• https://bdu.fstec.ru/vul/2015-06340 · Security Note
• https://bdu.fstec.ru/vul/2016-02190 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4243 · Security Note
• https://bdu.fstec.ru/vul/2020-03281 · Security Note