Junglewise Threat Intelligence

CVE-2016-5317: libtiff PixarLogDecode buffer overflow in libtiff.so

CVE-2016-5317 · Severity: medium · CVSS 6.5 · Published 2017-01-20

Technologies: Libtiff. Vendors: Gnome, Libtiff.

Executive brief

A vulnerability exists in libtiff, a widely used library for processing TIFF images. When a user views or processes a specially crafted image file—for example, through the GNOME Nautilus file manager—the application may crash. This can lead to a denial of service, preventing users from browsing files or using applications that rely on this library for image rendering.

Technical details

A heap-based buffer overflow exists in the PixarLogDecode function within libtiff.so (version 4.0.6 and earlier). The vulnerability is caused by insufficient bounds checking when processing PixarLog compressed TIFF images, leading to an out-of-bounds write that can corrupt adjacent heap memory. An attacker can exploit this by providing a malformed TIFF file; when a vulnerable application (such as GNOME Nautilus during thumbnail generation) attempts to decode the image, it triggers a segmentation fault during memory allocation or deallocation (e.g., in _int_free). While primarily a denial-of-service vector, heap corruption vulnerabilities can sometimes be leveraged for further exploitation depending on the memory allocator's state. Fixes are available in libtiff 4.0.7 and various downstream Linux distribution updates.

Affected products

  • libtiff libtiff 4.0.6 and earlier
  • GNOME nautilus 3.18.5 and earlier

Timeline

  • 2016-06-15: disclosed: Public disclosure on oss-security mailing list
  • 2017-01-13: patched: Debian released security update DSA-3762-1
  • 2017-01-20: advisory: NVD published CVE-2016-5317

References

Related threats