CVE-2016-9535

CVSS 9.8 CRITICALEPSS 4.8%CWE-119

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.8EPSS 4.8%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

22 nov 2016Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

n/a · n/a

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://rhn.redhat.com/errata/RHSA-2017-0225.html https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1 https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33 http://www.debian.org/security/2017/dsa-3844 http://www.securityfocus.com/bid/94484 http://www.securityfocus.com/bid/94744