CVE-2006-3459

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 53%

from disclosure to weapon1322 days

Published on NVDAug 3

1st PoC+1322d

metasploitAug 1

exploitation probability

53%top 1% of all CVEs

observed exploitation

nono source reports it

6 public exploit(s)

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.

Affected products

n/a · n/a

public PoCs found — 6

exploitdbwww.exploit-db.com/exploits/16862unverified exploitdbwww.exploit-db.com/exploits/16868unverified exploitdbwww.exploit-db.com/exploits/16869unverified exploitdbwww.exploit-db.com/exploits/21869unverified exploitdbwww.exploit-db.com/exploits/21868unverified exploitdbwww.exploit-db.com/exploits/11787unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html http://lwn.net/Alerts/194228/http://secunia.com/advisories/21253 http://secunia.com/advisories/21274 http://secunia.com/advisories/21290 http://secunia.com/advisories/21304 http://secunia.com/advisories/21319 http://secunia.com/advisories/21334 http://secunia.com/advisories/21338 http://secunia.com/advisories/21346