Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2016-5314

Disclosure Date: March 12, 2018 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

debian,
libtiff,
opensuse,
redhat

Products

debian linux 8.0,
debian linux 9.0,
enterprise linux 6.0,
enterprise linux 7.0,
leap 42.1,
libtiff,
opensuse 13.1,
opensuse 13.2

References

Canonical

CVE-2016-5314 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5314)

BID-91195 (http://www.securityfocus.com/bid/91195)

BID-91245 (http://www.securityfocus.com/bid/91245)

Advisory

DSA-3762 (https://www.debian.org/security/2017/dsa-3762)

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.html

http://lists.opensuse.org/opensuse-updates/2016-09/msg00060.html

[oss-security] 20160615 CVE-2016-5314: libtiff 4.0.6 PixarLogDecode() out-of-bound writes (http://www.openwall.com/lists/oss-security/2016/06/15/1)

https://bugzilla.redhat.com/show_bug.cgi?id=1346687

https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2

GLSA-201701-16 (https://security.gentoo.org/glsa/201701-16)

http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.html

http://lists.opensuse.org/opensuse-updates/2016-09/msg00090.html

[oss-security] 20160615 CVE-2016-5320: libtiff 4.0.6 rgb2ycbcr: command excution (http://www.openwall.com/lists/oss-security/2016/06/15/9)

[oss-security] 20160630 Re: Re: CVE request: Heap-based buffer overflow in LibTIFF when using the PixarLog compression format (http://www.openwall.com/lists/oss-security/2016/06/30/3)

http://bugzilla.maptools.org/show_bug.cgi?id=2554

Rapid7

Technical Analysis