CVE-2016-3991: Buffer Overflow
An Out-of-bounds write vulnerability caused by heap overflow when using tiffcrop tool was found in the libtiff library. The vulnerability is in loadImage() function in tiffcrop.c. loadImage() will read the numbers of tiles by calling TIFFNumberOfTiles().
However, if the numbers of tiles is 0, loadImage() will still read tile data by calling readContigTilesIntoBuffer() from the image, regardless of the numbers. In that case, loadImage() will allocate 3 bytes in the heap to store a tile data.
This creates a potential attack vector via crafted tiff tiles, which may result in DoS or code execution.
Upstream bug report: http://bugzilla.maptools.org/showbug.cgi?id=2543
Other sources
Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3991?
CVE-2016-3991 is considered to have a medium severity due to the potential for exploitation through out-of-bounds write vulnerabilities.
How do I fix CVE-2016-3991?
To fix CVE-2016-3991, upgrade the libtiff library to a version greater than 4.0.6 or apply any available patches from your distribution.
What software is affected by CVE-2016-3991?
CVE-2016-3991 affects the libtiff library, particularly versions up to and including 4.0.6.
What could happen if CVE-2016-3991 is exploited?
Exploitation of CVE-2016-3991 could lead to arbitrary code execution or crashes of the application using libtiff.
Is CVE-2016-3991 specific to certain operating systems?
CVE-2016-3991 is present in various systems, including Debian and Oracle VM Server, depending on the version of the libtiff library in use.