CVE-2016-9534: Buffer Overflow
Published Nov 22, 2016
·Updated
tifwrite.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tifrawcc and tifrawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."
Affected Software
2 affected componentsFixes available
debian/tiff
4.1.0+git191117-2~deb10u44.1.0+git191117-2~deb10u84.2.0-1+deb11u44.5.0-64.5.1+git230720-1
LibTIFF libtiff=4.0.6
Remediation
Event History
Nov 22, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9534?
CVE-2016-9534 is rated as a medium severity vulnerability due to its potential to cause heap buffer overflow.
2
How do I fix CVE-2016-9534?
To fix CVE-2016-9534, upgrade to a patched version of libtiff, specifically versions 4.1.0 or later.
3
What software is affected by CVE-2016-9534?
CVE-2016-9534 affects libtiff version 4.0.6 and potentially other earlier versions of the library.
4
What vulnerabilities does CVE-2016-9534 relate to?
CVE-2016-9534 is specifically related to the improper error handling in the TIFFFlushData1 function.
5
Is CVE-2016-9534 exploitable?
Yes, CVE-2016-9534 can be exploited to potentially allow an attacker to execute arbitrary code.