CVE-2016-3621

Name of the Vulnerable Software and Affected Versions LibTIFF versions 4.0.6 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically a buffer over-read, through a crafted BMP image when the "-c lzw" option is used. This is due to a problem in the LZWEncode function in tif lzw.c in the bmp2tiff tool.

Recommendations For LibTIFF versions 4.0.6 and earlier, consider disabling the use of the "-c lzw" option until a patch is available to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.