Buffer overflow in LibTIFF - CVE-2016-9535

Vulnerability identifier: #VU40040

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9535

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."

LibTIFF
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Microsoft Windows
Windows Server
Dynamic System Analysis (DSA) Preboot
libtiff (Red Hat package)

Install update from vendor's website.

Microsoft Windows - addressed in versions 10 21H2 10.0.19044.6456, 10 22H2 10.0.19045.6456, 10 1507 10.0.10240.21161, 10 1607 10.0.14393.8519, 10 1809 10.0.17763.7919, 11 22H2 10.0.22621.6060, 11 23H2 10.0.22631.6060, 11 24H2 10.0.26100.6899
Windows Server - addressed in versions 2008 R2 6.1.7601.27974, 2008 6.0.6003.23571, 2012 R2 6.3.9600.22824, 2012 6.2.9200.25722, 2016 10.0.14393.8519, 2019 10.0.17763.7919, 2022 23H2 10.0.25398.1913, 2022 10.0.20348.4294, 2025 10.0.26100.6899
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff (Red Hat package) - addressed in versions 3.9.4-21.el6_8, 4.0.3-27.el7_3

• http://rhn.redhat.com/errata/RHSA-2017-0225.html
• http://www.debian.org/security/2017/dsa-3844
• http://www.securityfocus.com/bid/94484
• http://www.securityfocus.com/bid/94744
• https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1
• https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33

• Multiple vulnerabilities in LibTIFF
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 update for libtiff
• Microsoft Windows update for LibTIFF