Stack-based buffer overflow in LibTIFF - CVE-2016-10095

Vulnerability identifier: #VU7402

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10095

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exits due to stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

LibTIFF
Debian Linux
Arch Linux
Slackware Linux
Fedora
Dynamic System Analysis (DSA) Preboot
libtiff
mingw-libtiff

Update to version 4.0.8-3.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libtiff - update to 4.0.9
mingw-libtiff - update to 4.0.9-1.fc28

• https://github.com/asarubbo/poc/blob/master/00104-libtiff-stackoverflow-_TIFFVGetField

• Debian update for tiff
• Arch Linux update for libtiff
• Arch Linux update for lib32-libtiff
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Slackware Linux update for libtiff
• Fedora 28 update for mingw-libtiff