Division by zero in LibTIFF - CVE-2016-10266
Published: March 24, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU32098
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10266
CWE-ID: CWE-369
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide-by-zero error within LibTIFF 4.0.7. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22.
Affected software
LibTIFF
tiff (Alpine package)
libtiff
SUSE Linux
Fedora
Opensuse
Dynamic System Analysis (DSA) Preboot
tiff (Alpine package)
libtiff
SUSE Linux
Fedora
Opensuse
Dynamic System Analysis (DSA) Preboot
How to mitigate CVE-2016-10266
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
tiff (Alpine package) - addressed in versions 4.0.7-r3, 4.0.8-r0
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff - addressed in versions 4.0.7-4.fc25, 4.0.7-4.fc26
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff - addressed in versions 4.0.7-4.fc25, 4.0.7-4.fc26