CVE-2016-3623: Divide by Zero
Published Oct 3, 2016
·Updated
The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0.
Affected Software
3 affected componentsFixes available
debian/tiff
4.1.0+git191117-2~deb10u44.1.0+git191117-2~deb10u84.2.0-1+deb11u44.5.0-64.5.1+git230720-1
LibTIFF libtiff<=4.0.6
openSUSE openSUSE=13.2
Event History
Oct 3, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3623?
CVE-2016-3623 is classified as a denial of service vulnerability due to a divide-by-zero error.
2
How do I fix CVE-2016-3623?
To mitigate CVE-2016-3623, upgrade LibTIFF to version 4.1.0 or later.
3
What software is affected by CVE-2016-3623?
CVE-2016-3623 affects LibTIFF versions up to 4.0.6 and the tiff package in specific Debian and openSUSE releases.
4
Can CVE-2016-3623 be exploited remotely?
Yes, CVE-2016-3623 can be exploited by remote attackers by manipulating input parameters.
5
What could happen if CVE-2016-3623 is exploited?
Exploitation of CVE-2016-3623 could lead to application crashes and service disruption.