CVE-2016-5315: Medium severity LibTIFF libtiff vulnerability
A vulnerability was found in libtiff. A maliciously crafted TIFF file could cause the application to crash when using rgb2ycbcr.
References:
http://seclists.org/oss-sec/2016/q2/544
Other sources
The setByteArray function in tifdir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5315?
CVE-2016-5315 is considered a moderate severity vulnerability due to its potential to cause application crashes from malicious TIFF files.
How do I fix CVE-2016-5315?
To fix CVE-2016-5315, upgrade to a version of the libtiff library that is 4.1.0+git191117-2~deb10u4 or later.
What versions are affected by CVE-2016-5315?
CVE-2016-5315 affects libtiff versions up to and including 4.0.6.
Which software utilizes libtiff that may be impacted by CVE-2016-5315?
Software packages that utilize libtiff include tiff and any applications depending on this library for TIFF file processing.
What can an attacker do with CVE-2016-5315?
An attacker can create malicious TIFF files that, when opened by vulnerable applications using libtiff, may lead to application crashes.