CVE-2015-8668

CWE-787 — Out-of-bounds WriteCWE-119 — Buffer OverflowCWE-122 — Heap-based Buffer Overflow9 documents8 sources
Severity
9.8CRITICAL
EPSS
7.4%
top 8.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Libtiff LibtiffOracle LinuxOracle VM Server+3 more
Timeline
PublishedJan 8
Latest updateMay 14

Description

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶NVDlibtiff/libtiff4.0.6
▶Debiantiff< 4.0.6-3+3
▶NVDoracle/linux6, 7+1
▶NVDoracle/vm_server3.3, 3.4+1

Also affects: Enterprise Linux 6.0, 7.0

🔴Vulnerability Details

3
GHSA
GHSA-mgjx-j5p2-m66r: Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits↗2022-05-14
▶
CVEList
CVE-2015-8668: Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits↗2016-01-08
▶
OSV
CVE-2015-8668: Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits↗2016-01-08
▶

📋Vendor Advisories

4
Ubuntu
LibTIFF vulnerabilities↗2017-07-19
▶
Ubuntu
LibTIFF vulnerabilities↗2017-02-27
▶
Red Hat
libtiff: OOB read in bmp2tiff↗2015-12-28
▶
Debian
CVE-2015-8668: tiff - Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c i...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-8668 libtiff: OOB read in bmp2tiff↗2015-12-28
▶
CVE-2015-8668 (CRITICAL CVSS 9.8) | Heap-based buffer overflow in the P | cvebase.io