CVE-2016-5316

Out-of-bounds read in the PixarLogCleanup function in tifpixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool...

CVE-2016-9297

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via crafted TIFFSETGETC16ASCII or TIFFSETGETC32ASCII tag values...

CVE-2016-9273

tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via a crafted file, related to changing tdnstrips in TIFFSTRIPCHOP mode...

Out-of-bounds

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via crafted TIFFSETGETC16ASCII or TIFFSETGETC32ASCII tag values...

CVE-2016-9273

CVE-2016-9273 affects LibTIFF (libtiff 4.0.6) via tiffsplit: a heap buffer overflow in cpStrips() allows crafted TIFF files to trigger denial of service (crash). CVE details in Debian/Arch/Gentoo advisories corroborate a memory corruption primitive leading to DoS, with fixed upstream in 4.0.7 (or...

CVE-2016-9273

tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via a crafted file, related to changing tdnstrips in TIFFSTRIPCHOP mode...

CVE-2016-9297

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via crafted TIFFSETGETC16ASCII or TIFFSETGETC32ASCII tag values...

CVE-2016-9273

tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service out-of-bounds read via a crafted file, related to changing tdnstrips in TIFFSTRIPCHOP mode...

CVE-2016-9448

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service NULL pointer dereference and crash by setting the tags TIFFSETGETC16ASCII or TIFFSETGETC32ASCII to values that access 0-byte arrays. NOTE: this vulnerability exists because of an incomplete fix f...

CVE-2016-9536

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2pprocessjpegstrip. Reported as MSVR 35098, aka "t2pprocessjpegstrip heap-buffer-overflow."...

LibTIFF tools/tiff2pdf.c Out-of-bounds Write Heap Buffer Overflow Overflow Vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in libtiff version 4.0.6 in tools/tiff2pdf.c, which can be...

LibTIFF tif_write.c Heap Buffer Overflow Vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in libtiff version 4.0.6 in tifwrite.c, which can be exploit...

CVE-2016-9540

tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."...

CVE-2016-9539

tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer. Reported as MSVR 35092...

CVE-2016-9535

tifpredict.h and tifpredict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."...

CVE-2016-9535

tifpredict.h and tifpredict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."...

Out-of-bounds

tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer. Reported as MSVR 35092...

Heap overflow

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2pprocessjpegstrip. Reported as MSVR 35098, aka "t2pprocessjpegstrip heap-buffer-overflow."...

Heap overflow

tifwrite.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1 that didn't reset the tifrawcc and tifrawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."...

CVE-2016-9539

CVE-2016-9539: In LibTIFF 4.0.6, tools/tiffcrop.c reads an out-of-bounds buffer in readContigTilesIntoBuffer(), yielding a potential crash or memory corruption when processing crafted TIFF files. Connected advisories enumerate LibTIFF 4.x variants with multiple related issues, but do not provide ...