CVE-2016-3620

Name of the Vulnerable Software and Affected Versions LibTIFF versions 4.0.6 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically a buffer over-read, via a crafted BMP image when the "-c zip" option is used with the ZIPEncode function in the bmp2tiff tool.

Recommendations For LibTIFF versions 4.0.6 and earlier, consider avoiding the use of the "-c zip" option with the bmp2tiff tool until a fix is available. As a temporary workaround, restrict the processing of BMP images from untrusted sources to minimize the risk of exploitation.