{"id":"CVE-2016-10095","aliases":["DEBIAN-CVE-2016-10095","DLA-983-1","DLA-984-1","EUVD-2016-1287","GHSA-r834-wg3m-jhqm","MGASA-2017-0199","SUSE-SU-2018:0073-1","SUSE-SU-2018:1179-1","SUSE-SU-2018:1835-1","openSUSE-SU-2024:11461-1"],"status":"published","title":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4...","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02598,"percentile":0.85447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-03-01T15:00:00Z","modified":"2026-10-24T10:30:26Z","fixes":[{"ecosystem":"Debian:12","package":"tiff","fixed_in":["4.0.8-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tiff","fixed_in":["4.0.8-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.0.8-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tiff3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-11+deb7u6"}]}],"versions":["3.9.6-11","3.9.6-11+deb7u1","3.9.6-11+deb7u2","3.9.6-11+deb7u3","3.9.6-11+deb7u4","3.9.6-11+deb7u5"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-6+deb7u14"}]}],"versions":["4.0.2-6","4.0.2-6+deb7u1","4.0.2-6+deb7u10","4.0.2-6+deb7u11","4.0.2-6+deb7u12","4.0.2-6+deb7u13","4.0.2-6+deb7u2","4.0.2-6+deb7u3","4.0.2-6+deb7u4","4.0.2-6+deb7u5","4.0.2-6+deb7u6","4.0.2-6+deb7u7","4.0.2-6+deb7u8","4.0.2-6+deb7u9"],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga5"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.7.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-141.169.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.3"}]}],"bundled":48}],"products":[{"vendor":"libtiff","product":"libtiff"}],"references":[{"url":"http://www.securityfocus.com/bid/95178","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://bugzilla.maptools.org/show_bug.cgi?id=2625","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/01/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow-in-_tiffvgetfield-tif_dir-c/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/01/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3903","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10095"},{"url":"https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow-in-_tiffvgetfield-tif_dir-c"},{"url":"https://github.com/advisories/GHSA-r834-wg3m-jhqm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10095","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20057","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180073-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1017690","tags":["report"]},{"url":"https://bugzilla.suse.com/1069213","tags":["report"]},{"url":"https://bugzilla.suse.com/960341","tags":["report"]},{"url":"https://bugzilla.suse.com/969783","tags":["report"]},{"url":"https://bugzilla.suse.com/983436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007280","tags":["report"]},{"url":"https://bugzilla.suse.com/1011107","tags":["report"]},{"url":"https://bugzilla.suse.com/1011845","tags":["report"]},{"url":"https://bugzilla.suse.com/1017688","tags":["report"]},{"url":"https://bugzilla.suse.com/1017691","tags":["report"]},{"url":"https://bugzilla.suse.com/1017692","tags":["report"]},{"url":"https://bugzilla.suse.com/1031255","tags":["report"]},{"url":"https://bugzilla.suse.com/1046077","tags":["report"]},{"url":"https://bugzilla.suse.com/1048937","tags":["report"]},{"url":"https://bugzilla.suse.com/1074318","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181835-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007276","tags":["report"]},{"url":"https://bugzilla.suse.com/1011839","tags":["report"]},{"url":"https://bugzilla.suse.com/1011846","tags":["report"]},{"url":"https://bugzilla.suse.com/1017689","tags":["report"]},{"url":"https://bugzilla.suse.com/1019611","tags":["report"]},{"url":"https://bugzilla.suse.com/1031263","tags":["report"]},{"url":"https://bugzilla.suse.com/1082332","tags":["report"]},{"url":"https://bugzilla.suse.com/1082825","tags":["report"]},{"url":"https://bugzilla.suse.com/1086408","tags":["report"]},{"url":"https://bugzilla.suse.com/974621","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8905","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7663","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10095","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2017-03-01T15:00:00Z","modified":"2024-08-06T03:07:32.13Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1287","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2017-03-01T15:00:00Z","modified":"2024-08-06T03:07:32Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-r834-wg3m-jhqm","title":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4...","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2022-05-13T01:11:53Z","modified":"2025-04-20T03:34:28Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:41.934315Z"}],"nvd":[{"id":"CVE-2016-10095","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2017-03-01T15:59:00.29Z","modified":"2026-06-17T00:39:02.91Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-10095","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2017-03-01T15:59:00.29Z","modified":"2026-10-24T10:30:26.036815616Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10095","description":"Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7 and 4.0.8 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.","status":"published","published":"2017-03-01T15:59:00.29Z","modified":"2026-09-22T07:01:12.035155084Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"DLA-983-1","title":"tiff3 - security update","status":"published","published":"2017-06-13T00:00:00Z","modified":"2026-03-09T02:09:36.961048Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DLA-984-1","title":"tiff - security update","status":"published","published":"2017-06-13T00:00:00Z","modified":"2026-03-09T02:09:43.012634Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0199","title":"Updated libtiff packages fix security vulnerability","description":"Heap-based buffer overflow in the readContigStripsIntoBuffer function in\ntif_unix.c in LibTIFF 4.0.7 allows remote attackers to have unspecified\nimpact via a crafted image. (CVE-2016-10092)\n\nInteger overflow in tools/tiffcp.c in LibTIFF 4.0.7 allows remote\nattackers to have unspecified impact via a crafted image, which triggers a\nheap-based buffer overflow.  (CVE-2016-10093)\n\nOff-by-one error in the t2p_readwrite_pdf_image_tile function in\ntools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have\nunspecified impact via a crafted image. (CVE-2016-10094)\n\nStack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service (crash)\nvia a crafted TIFF file. (CVE-2016-10095)\n\nLibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the\ntools/tiffcp resulting in DoS or code execution via a crafted\nBitsPerSample value. (CVE-2017-5225)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(divide-by-zero error and application crash) via a crafted TIFF image,\nrelated to libtiff/tif_read.c:351:22. (CVE-2016-10266)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(divide-by-zero error and application crash) via a crafted TIFF image,\nrelated to libtiff/tif_ojpeg.c:816:8. (CVE-2016-10267)\n\ntools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial\nof service (integer underflow and heap-based buffer under-read) or\npossibly have unspecified other impact via a crafted TIFF image, related\nto \"READ of size 78490\" and libtiff/tif_unix.c:115:23. (CVE-2016-10268)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer over-read) or possibly have unspecified other impact\nvia a crafted TIFF image, related to \"READ of size 512\" and\nlibtiff/tif_unix.c:340:2. (CVE-2016-10269)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer over-read) or possibly have unspecified other impact\nvia a crafted TIFF image, related to \"READ of size 8\" and\nlibtiff/tif_read.c:523:22. (CVE-2016-10270)\n\ntools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a\ndenial of service (heap-based buffer over-read and buffer overflow) or\npossibly have unspecified other impact via a crafted TIFF image, related\nto \"READ of size 1\" and libtiff/tif_fax3.c:413:13. (CVE-2016-10271)\n\nLibTIFF 4.0.7 allows remote attackers to cause a denial of service\n(heap-based buffer overflow) or possibly have unspecified other impact via\na crafted TIFF image, related to \"WRITE of size 2048\" and\nlibtiff/tif_next.c:64:9. (CVE-2016-10272)\n\nThe putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a\nleft-shift undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7592)\n\ntif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly\ninitialized, which might allow remote attackers to obtain sensitive\ninformation from process memory via a crafted image. (CVE-2017-7593)\n\nThe OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF\n4.0.7 allows remote attackers to cause a denial of service (memory leak)\nvia a crafted image. (CVE-2017-7594)\n\nThe JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote\nattackers to cause a denial of service (divide-by-zero error and\napplication crash) via a crafted image. (CVE-2017-7595)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nfloat\" undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7596)\n\ntif_dirread.c in LibTIFF 4.0.7 has an \"outside the range of representable\nvalues of type float\" undefined behavior issue, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7597)\n\ntif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a\ndenial of service (divide-by-zero error and application crash) via a\ncrafted image. (CVE-2017-7598)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nshort\" undefined behavior issue, which might allow remote attackers to\ncause a denial of service (application crash) or possibly have unspecified\nother impact via a crafted image. (CVE-2017-7599)\n\nLibTIFF 4.0.7 has an \"outside the range of representable values of type\nunsigned char\" undefined behavior issue, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7600)\n\nLibTIFF 4.0.7 has a \"shift exponent too large for 64-bit type long\"\nundefined behavior issue, which might allow remote attackers to cause a\ndenial of service (application crash) or possibly have unspecified other\nimpact via a crafted image. (CVE-2017-7601)\n\nLibTIFF 4.0.7 has a signed integer overflow, which might allow remote\nattackers to cause a denial of service (application crash) or possibly\nhave unspecified other impact via a crafted image. (CVE-2017-7602)\n\nThe TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the\ntiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause\na denial of service (out-of-bounds read) via vectors involving the ma\nvariable. (CVE-2016-3658)\n\ntif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can\nlead to assertion failures in debug mode, or buffer overflows in release\nmode, when dealing with unusual tile size like YCbCr with subsampling.\nReported as MSVR 35105, aka \"Predictor heap-buffer-overflow.\"\n(CVE-2016-9535)\n\nlibtiff: out-of-bounds write in multiple tools. (CVE-2014-8128)\n","status":"published","published":"2017-07-01T07:04:05Z","modified":"2026-04-16T06:26:29.012085607Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11461-1","title":"libtiff-devel-32bit-4.3.0-1.3 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.3.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:53.504228Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0073-1","title":"Security update for tiff","description":"This update for tiff to version 4.0.9 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2014-8128: Fix out-of-bounds read with malformed TIFF image in multiple tools (bsc#969783).\n- CVE-2015-7554: Fix invalid write in tiffsplit / _TIFFVGetField (bsc#960341).\n- CVE-2016-10095: Fix stack-based buffer overflow in _TIFFVGetField (tif_dir.c) (bsc#1017690).\n- CVE-2016-5318: Fix stackoverflow in thumbnail (bsc#983436).\n- CVE-2017-16232: Fix memory-based DoS in tiff2bw (bsc#1069213).\n","status":"published","published":"2018-01-12T10:19:09Z","modified":"2026-02-04T02:25:21.513266Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1179-1","title":"Security update for tiff","description":"\n  \nThis update for tiff fixes the following issues:\n\n- CVE-2016-9453: The t2p_readwrite_pdf_image_tile function allowed remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one (bsc#1011107).\n- CVE-2016-5652: An exploitable heap-based buffer overflow existed in the handling of TIFF images in the TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means (bsc#1007280).\n- CVE-2017-11335: There is a heap based buffer overflow in tools/tiff2pdf.c via a PlanarConfig=Contig image, which caused a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack (bsc#1048937).\n- CVE-2016-9536: tools/tiff2pdf.c had an out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka 't2p_process_jpeg_strip heap-buffer-overflow.'  (bsc#1011845)\n- CVE-2017-9935: In LibTIFF, there was a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution (bsc#1046077).\n- CVE-2017-17973: There is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)\n- CVE-2015-7554: The _TIFFVGetField function in tif_dir.c allowed attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image (bsc#960341).\n- CVE-2016-5318: Stack-based buffer overflow in the _TIFFVGetField function allowed remote attackers to crash the application via a crafted tiff (bsc#983436).\n- CVE-2016-10095: Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c allowed remote attackers to cause a denial of service (crash) via a crafted TIFF file (bsc#1017690,).\n- CVE-2016-10268: tools/tiffcp.c allowed remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to 'READ of size 78490' and libtiff/tif_unix.c:115:23 (bsc#1031255)\n- An overlapping of memcpy parameters was fixed which could lead to content corruption (bsc#1017691).\n- Fixed an invalid memory read which could lead to a crash (bsc#1017692).\n- Fixed a NULL pointer dereference in TIFFReadRawData (tiffinfo.c) that could crash the decoder (bsc#1017688).\n","status":"published","published":"2018-05-09T12:01:09Z","modified":"2025-05-02T04:04:45.690002Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1835-1","title":"Security update for tiff","description":"This update for tiff fixes the following security issues:\n\n- CVE-2017-5225: Prevent heap buffer overflow in the tools/tiffcp that could\n  have caused DoS or code execution via a crafted BitsPerSample value\n  (bsc#1019611)\n- CVE-2018-7456: Prevent a NULL Pointer dereference in the function\n  TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF\n  information, a different vulnerability than CVE-2017-18013 (bsc#1082825)\n- CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During\n  the TIFFOpen process, td_imagelength is not checked. The value of\n  td_imagelength can be directly controlled by an input file. In the\n  ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called\n  based on td_imagelength. If the value of td_imagelength is set close to the\n  amount of system memory, it will hang the system or trigger the OOM killer\n  (bsc#1082332)\n- CVE-2016-10266: Prevent remote attackers to cause a denial of service\n  (divide-by-zero error and application crash) via a crafted TIFF image, related\n  to libtiff/tif_read.c:351:22 (bsc#1031263)\n- CVE-2018-8905: Prevent heap-based buffer overflow in the function\n  LZWDecodeCompat via a crafted TIFF file (bsc#1086408)\n- CVE-2016-9540: Prevent out-of-bounds write on tiled images with odd tile\n  width versus image width (bsc#1011839).\n- CVE-2016-9535: tif_predict.h and tif_predict.c had assertions that could have\n  lead to assertion failures in debug mode, or buffer overflows in release mode,\n  when dealing with unusual tile size like YCbCr with subsampling (bsc#1011846).\n- CVE-2016-9535: tif_predict.h and tif_predict.c had assertions that could have\n  lead to assertion failures in debug mode, or buffer overflows in release mode,\n  when dealing with unusual tile size like YCbCr with subsampling (bsc#1011846).\n- Removed assert in readSeparateTilesIntoBuffer() function (bsc#1017689).\n- CVE-2016-10095: Prevent stack-based buffer overflow in the _TIFFVGetField\n  function that allowed remote attackers to cause a denial of service (crash) via\n  a crafted TIFF file (bsc#1017690).\n- CVE-2016-8331: Prevent remote code execution because of incorrect handling of\n  TIFF images. A crafted TIFF document could have lead to a type confusion\n  vulnerability resulting in remote code execution. This vulnerability could have\n  been be triggered via a TIFF file delivered to the application using LibTIFF's\n  tag extension functionality (bsc#1007276).\n- CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to cause\n  a denial of service (out-of-bounds write) or execute arbitrary code via a\n  crafted TIFF image (bsc#974621).\n","status":"published","published":"2018-06-28T09:41:44Z","modified":"2026-02-04T03:58:06.012099Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}