CVE-2016-9297 — Out-of-bounds Read in Tiff

CWE-125 — Out-of-bounds ReadCWE-476 — NULL Pointer DereferenceCWE-170 — Improper Null Termination19 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 30.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian TiffLibtiffOpensuse
Timeline
PublishedJan 18
Latest updateMay 17

Description

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDlibtiff/libtiff4.0.6
▶debiandebian/tiff< tiff 4.0.7-1 (bookworm)+1

Patches

Patch: bugzilla.maptools.org ↗Patch: bugzilla.maptools.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-fjx8-f7rq-fqgx: The TIFFFetchNormalTag function in LibTiff 4↗2022-05-17
▶
GHSA
GHSA-fh4x-w635-c436: The TIFFFetchNormalTag function in LibTiff 4↗2022-05-14
▶
OSV
CVE-2016-9448: The TIFFFetchNormalTag function in LibTiff 4↗2017-01-27
▶
OSV
CVE-2016-9297: The TIFFFetchNormalTag function in LibTiff 4↗2017-01-18
▶

📋Vendor Advisories

5
Ubuntu
LibTIFF vulnerabilities↗2017-02-27
▶
Red Hat
libtiff: Null pointer dereference in TIFFFetchNormalTag() (regression of CVE-2016-9297)↗2016-11-16
▶
Red Hat
libtiff: Out-of-bounds heap read in _TIFFPrintField (tif_print.c:127)↗2016-11-07
▶
Debian
CVE-2016-9448: tiff - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to caus...↗2016
▶
Debian
CVE-2016-9297: tiff - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to caus...↗2016
▶

💬Community

8
HackerOne
libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297)↗2019-10-04
▶
Bugzilla
CVE-2016-9448 libtiff: Null pointer dereference in TIFFFetchNormalTag() (regression of CVE-2016-9297)↗2016-11-23
▶
Bugzilla
CVE-2016-9273 CVE-2016-9277 CVE-2016-9297 mingw-libtiff: various flaws [fedora-all]↗2016-11-15
▶
Bugzilla
CVE-2016-9297 libtiff: Out-of-bounds heap read in _TIFFPrintField (tif_print.c:127)↗2016-11-15
▶
Bugzilla
CVE-2016-9273 CVE-2016-9277 CVE-2016-9297 libtiff: various flaws [fedora-all]↗2016-11-15
▶