CVE-2016-10269: High severity LibTIFF libtiff vulnerability

Published Mar 24, 2017

Updated

Last updated 24 July 2024

Other sources

LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6 and 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tifunix.c:340:2.

Affected Software

2 affected componentsFixes available

LibTIFF libtiff=4.0.7

debian/tiff

4.5.0-6+deb12u44.7.0-3+deb13u34.7.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/tiff to a version that resolves this vulnerability.
Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1

Event History

Mar 24, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-3844

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-877-1

Frequently Asked Questions

What is the severity of CVE-2016-10269?

CVE-2016-10269 is classified as a denial of service vulnerability due to heap-based buffer over-read.

How do I fix CVE-2016-10269?

To fix CVE-2016-10269, update to the patched versions of the affected tiff package, specifically 4.2.0-1+deb11u5, 4.2.0-1+deb11u6, or higher.

Which versions of LibTIFF are affected by CVE-2016-10269?

CVE-2016-10269 affects LibTIFF versions 4.0.0alpha4 through 4.0.7.

What impact can CVE-2016-10269 have on systems?

CVE-2016-10269 can lead to a denial of service condition, potentially allowing attackers to disrupt services.

Is CVE-2016-10269 exploitable remotely?

Yes, CVE-2016-10269 can be exploited remotely through crafted TIFF images.