CVE-2016-9448 — NULL Pointer Dereference in Libtiff

CWE-476 — NULL Pointer Dereference10 documents7 sources

Severity

7.5HIGHNVD

EPSS

2.1%

top 16.01%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Libtiff Opensuse Debian Tiff

Timeline

PublishedJan 27

Latest updateMay 14

Description

The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDlibtiff/libtiff4.0.6

▶debiandebian/tiff

▶NVDopensuse/opensuse13.2

🔴Vulnerability Details

GHSA

GHSA-fh4x-w635-c436: The TIFFFetchNormalTag function in LibTiff 4↗2022-05-14

▶

OSV

CVE-2016-9448: The TIFFFetchNormalTag function in LibTiff 4↗2017-01-27

▶

📋Vendor Advisories

Ubuntu

LibTIFF vulnerabilities↗2017-02-27

▶

Red Hat

libtiff: Null pointer dereference in TIFFFetchNormalTag() (regression of CVE-2016-9297)↗2016-11-16

▶

Debian

CVE-2016-9448: tiff - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to caus...↗2016

▶

💬Community

Bugzilla

CVE-2016-9448 libtiff: Null pointer dereference in TIFFFetchNormalTag() (regression of CVE-2016-9297)↗2016-11-23

▶

Bugzilla

CVE-2016-9448 CVE-2016-9453 CVE-2016-9532 CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 CVE-2016-9536 CVE-2016-9537 CVE-2016-9538 CVE-2016-9539 CVE-2016-9540 mingw-libtiff: various flaws [fedora-all]↗2016-11-23

▶

Bugzilla

▶

Bugzilla

CVE-2016-9448 CVE-2016-9453 CVE-2016-9532 CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 CVE-2016-9536 CVE-2016-9537 CVE-2016-9538 CVE-2016-9539 CVE-2016-9540 libtiff: various flaws [fedora-all]↗2016-11-23

▶