CVE-2016-3623

libtiff: divide by zero in the rgb2ycybr tool

The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Libtiff Opensuse

Products

Libtiff Opensuse

CVE-2016-3624

libtiff: out of bounds write in the rgb2ycybr tool

The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) by setting the "-v" option to -1.

CVSS 3.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3625

libtiff: out of bounds read in the tiff2bw tool

tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3634

libtiff: out-of-bounds read in the tagCompare function

The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching.

CVSS 3.0 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3619

libtiff: bmp2tiff DumpModeEncode OOB read

The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3620

libtiff: Out-of-bound read in ZIPEncode

The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3621

libtiff: out of bounds read in the bmp2tiff tool

The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3631

libtiff: thumbnail tool out-of-bounds read vulnerabilities

The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the bytecounts[] array variable.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-3632

libtiff: out-of-bounds write in _TIFFVGetField function

The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image.

CVSS 3.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Vm Server Enterprise Linux

CVE-2016-3633

libtiff: out-of-bounds read in the _setrow function

The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable.

CVSS 3.0 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2014-9330

libtiff: Out-of-bounds reads followed by a crash in bmp2tiff

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

CVSS 3.0 · 3.3 Low EPSS 4.1% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2016-3945

libtiff: out-of-bounds write in the tiff2rgba tool

Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.

CVSS 3.0 · 7.8 High EPSS 3.5% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Vm Server Enterprise Linux

CVE-2016-3990

libtiff: out-of-bounds write in horizontalDifference8()

Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.

CVSS 3.0 · 7.8 High EPSS 3.8% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Vm Server Enterprise Linux

CVE-2016-3991

libtiff: out-of-bounds write in loadImage() function

Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles.

CVSS 3.0 · 7.8 High EPSS 3.7% KEV · Not listed

Vendors

Libtiff Oracle Redhat

Products

Libtiff Vm Server Enterprise Linux

CVE-2016-8331

libtiff: FAX IFD Entry Parsing Type Confusion

An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.

CVSS 3.0 · 8.1 High EPSS 6.6% KEV · Not listed

Vendors

Libtiff

Products

Libtiff

CVE-2016-9533

libtiff: PixarLog horizontalDifference heap-buffer-overflow

tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2016-9534

libtiff: TIFFFlushData1 heap-buffer-overflow

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2016-9536

libtiff: t2p_process_jpeg_strip heap-buffer-overflow

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2016-9537

libtiff: Out-of-bounds write vulnerabilities in tools/tiffcrop.c

tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux

CVE-2016-9538

libtiff: Integer overflow leads to reading undefined buffer in readContigStripsIntoBuffer()

tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Libtiff

Products

Libtiff