PT-2016-7767

CVE-2016-9533

Published

2016-11-22

Updated

2018-01-05

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libtiff version 4.0.6

Description The issue is related to out-of-bounds write vulnerabilities in heap allocated buffers, specifically in the tif pixarlog.c file. This can lead to a heap-buffer-overflow, which has been reported as "PixarLog horizontalDifference heap-buffer-overflow."

Recommendations For libtiff version 4.0.6, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Axel Souchet

Suha Can

Vishal Chauhan

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-787: Out-of-bounds Write

Related identifiers

CVE-2016-9533