CVE-2016-9532: Integer Overflow
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Other sources
Multiple integer overflows were found in writeBufferToSeparateStrips(), writeBufferToContigTiles() and writeBufferToSeparateTiles() that could lead to out-of-bounds heap read.
Upstream bug:
http://bugzilla.maptools.org/showbug.cgi?id=2592
CVE assignment:
http://seclists.org/oss-sec/2016/q4/487
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9532?
CVE-2016-9532 is classified as a denial of service vulnerability due to integer overflow leading to out-of-bounds reads.
How do I fix CVE-2016-9532?
To fix CVE-2016-9532, you should upgrade to LibTIFF version 4.0.7 or later.
What software is affected by CVE-2016-9532?
CVE-2016-9532 affects versions of LibTIFF prior to 4.0.7, including the tiff package on Debian systems.
Can CVE-2016-9532 be exploited remotely?
Yes, CVE-2016-9532 can be exploited remotely by attackers using crafted tif files.
What functions are involved in CVE-2016-9532?
The vulnerability lies in the writeBufferToSeparateStrips and writeBufferToContigTiles functions in tiffcrop.c.