Junglewise Threat Intelligence

CVE-2016-5316: Libtiff out-of-bounds read in PixarLogCleanup

CVE-2016-5316 · Severity: medium · CVSS 6.5 · Published 2017-01-20

Technologies: Libtiff. Vendors: Libtiff.

Executive brief

A vulnerability exists in libtiff, a widely used library for processing TIFF image files. By tricking a user or system into processing a specially crafted image, an attacker can cause the application to crash. This results in a denial-of-service, potentially disrupting business operations that rely on image processing or document management.

Technical details

An out-of-bounds read vulnerability exists in the PixarLogCleanup function within tif_pixarlog.c in libtiff versions 4.0.6 and earlier. The flaw is triggered when the library processes a maliciously crafted TIFF image, specifically when using tools like rgb2ycbcr. The root cause involves improper memory handling during the cleanup of PixarLog compressed data, leading to a segmentation fault. An attacker can exploit this by providing a crafted file to be processed by an application linked against the vulnerable library. This issue has been addressed in libtiff version 4.0.7 and various downstream distribution patches (e.g., Debian, openSUSE).

Affected products

  • libtiff libtiff 4.0.6 and earlier

Timeline

  • 2016-06-15: disclosed: Initial disclosure on oss-security mailing list
  • 2017-01-09: patched: Gentoo released advisory for version 4.0.7
  • 2017-01-13: patched: Debian released security update DSA-3762-1
  • 2017-01-20: advisory: NVD published CVE-2016-5316 details

References