CVE-2016-6223 — Out-of-bounds Read in Libtiff

CWE-189CWE-125 — Out-of-bounds Read10 documents7 sources
Severity
9.1CRITICALNVD
EPSS
1.2%
top 20.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian TiffLibtiff
Timeline
PublishedJan 23
Latest updateMay 17

Description

The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDlibtiff/libtiff4.0.6
▶debiandebian/tiff< tiff 4.0.6-2 (bookworm)

Patches

Patch: libtiff.maptools.org ↗Patch: libtiff.maptools.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-5rxj-349x-j69q: The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read↗2022-05-17
▶
OSV
CVE-2016-6223: The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read↗2017-01-23
▶

📋Vendor Advisories

3
Ubuntu
LibTIFF vulnerabilities↗2017-02-27
▶
Red Hat
libtiff: Out-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1()↗2016-07-10
▶
Debian
CVE-2016-6223: tiff - The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff be...↗2016
▶

💬Community

4
Bugzilla
CVE-2016-6223 mingw-libtiff: libtiff: Uut-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() [epel-all]↗2016-07-15
▶
Bugzilla
CVE-2016-6223 libtiff: Out-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1()↗2016-07-15
▶
Bugzilla
CVE-2016-6223 mingw-libtiff: libtiff: Uut-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() [fedora-all]↗2016-07-15
▶
Bugzilla
CVE-2016-6223 libtiff: Uut-of-bounds read on memory-mapped files in TIFFReadRawStrip1() and TIFFReadRawTile1() [fedora-all]↗2016-07-15
▶