Is CVE-2016-9448 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9448 being exploited in the wild.

How severe is CVE-2016-9448?

High severity, with a CVSS score of 7.5, published 27 January 2017.

Is there a fix for CVE-2016-9448?

A patch was published on 2016-11-16: Fix committed to LibTiff CVS repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9448 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-9448?

Check whether you run Libtiff or Opensuse. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9448: LibTiff NULL pointer dereference in TIFFFetchNormalTag

CVE-2016-9448 · Severity: high · CVSS 7.5 · Published 2017-01-27

LibTiff is a widely used library for reading and writing Tag Image File Format (TIFF) files, often utilized by image viewers and document processing software. A vulnerability in this library allows a remote attacker to crash applications that process specially crafted TIFF images. This results in a denial-of-service condition, potentially disrupting business operations or services that handle automated image processing.

Technologies: Libtiff, Opensuse. Vendors: Libtiff, Opensuse.

Quick answers

Is CVE-2016-9448 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9448 being exploited in the wild.
How severe is CVE-2016-9448?: High severity, with a CVSS score of 7.5, published 27 January 2017.
Which products and versions are affected?: LibTiff Project LibTiff 4.0.6.
Is there a fix for CVE-2016-9448?: A patch was published on 2016-11-16: Fix committed to LibTiff CVS repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9448 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-9448?: Check whether you run Libtiff or Opensuse. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in the TIFFFetchNormalTag function within tif_dirread.c of LibTiff 4.0.6. The vulnerability is triggered when the library processes TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tags that point to 0-byte arrays, leading to an invalid memory access and subsequent process crash. This issue stemmed from an incomplete fix for a previous vulnerability (CVE-2016-9297). An attacker can exploit this by providing a malicious TIFF file to any application linked against the vulnerable library. The issue was resolved in LibTiff version 4.0.7 and various downstream Linux distribution patches.

Affected products

LibTiff Project LibTiff 4.0.6

Timeline

2016-11-16: disclosed: Bug reported to LibTiff Bugzilla (Bug 2593)
2016-11-16: patched: Fix committed to LibTiff CVS repository
2016-11-18: other: CVE-2016-9448 assigned
2017-01-27: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.