Vulnerability Name:

CVE-2016-5315 (CCN-114297)

Assigned:2016-06-15
Published:2016-06-15
Updated:2017-03-08
Summary:The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-125
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2016-5315

Source: CCN
Type: oss-sec Mailing List, Wed, 15 Jun 2016 02:31:43 +0000
CVE-2016-5315: libtiff 4.0.6 tif_dir.c: setByteArray() Read access violation

Source: DEBIAN
Type: Third Party Advisory
DSA-3762

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20160615 CVE-2016-5315: libtiff 4.0.6 tif_dir.c: setByteArray() Read access violation

Source: CCN
Type: LibTIFF Web site
LibTIFF - TIFF Library and Utilities

Source: BID
Type: Third Party Advisory, VDB Entry
91204

Source: CCN
Type: BID-91204
LibTIFF 'tif_dir.c' Out of Bounds Read Denial of Service Vulnerability

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1346694

Source: XF
Type: UNKNOWN
libtiff-cve20165315-dos(114297)

Source: GENTOO
Type: Third Party Advisory, VDB Entry
GLSA-201701-16

Vulnerable Configuration:Configuration 1:
  • cpe:/a:libtiff:libtiff:*:*:*:*:*:*:*:* (Version <= 4.0.6)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:libtiff:libtiff:4.0.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20165315
    V
    		CVE-2016-5315
    2022-05-20
    oval:org.opensuse.security:def:29496
    P
    		Security update for libsndfile (Important)
    2022-01-05
    oval:org.opensuse.security:def:35281
    P
    		Security update for libvpx (Moderate)
    2021-12-23
    oval:org.opensuse.security:def:31335
    P
    		Security update for xorg-x11-server (Important)
    2021-12-20
    oval:org.opensuse.security:def:30284
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:34591
    P
    		Security update for libarchive (Moderate)
    2021-11-17
    oval:org.opensuse.security:def:31701
    P
    		Security update for pcre (Moderate)
    2021-11-10
    oval:org.opensuse.security:def:29442
    P
    		Security update for binutils (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:30116
    P
    		Security update for python-PyYAML (Important)
    2021-08-24
    oval:org.opensuse.security:def:31248
    P
    		Security update for cpio (Important)
    2021-08-23
    oval:org.opensuse.security:def:34501
    P
    		Security update for fastjar (Low)
    2021-08-06
    oval:org.opensuse.security:def:33695
    P
    		Security update for djvulibre (Important)
    2021-08-05
    oval:org.opensuse.security:def:31657
    P
    		Security update for linuxptp (Important)
    2021-07-21
    oval:org.opensuse.security:def:30105
    P
    		Security update for qemu (Moderate)
    2021-07-21
    oval:org.opensuse.security:def:30104
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:32950
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:36430
    P
    		krb5-devel-1.6.3-133.49.66.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36388
    P
    		cyrus-imapd-devel-2.3.11-60.65.64.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31191
    P
    		Security update for gstreamer-plugins-bad (Important)
    2021-06-07
    oval:org.opensuse.security:def:34444
    P
    		Security update for postgresql13 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:33651
    P
    		Security update for xen (Important)
    2021-05-19
    oval:org.opensuse.security:def:30190
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:33085
    P
    		Security update for postgresql-jdbc (Moderate)
    2021-02-25
    oval:org.opensuse.security:def:28930
    P
    		Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP2) (Important)
    2021-02-10
    oval:org.opensuse.security:def:31635
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:31099
    P
    		Security update for clamav (Important)
    2020-12-22
    oval:org.opensuse.security:def:33627
    P
    		Security update for clamav (Important)
    2020-12-22
    oval:org.opensuse.security:def:34333
    P
    		Security update for openssl-1_1 (Important)
    2020-12-10
    oval:org.opensuse.security:def:28861
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP2) (Important)
    2020-12-07
    oval:org.opensuse.security:def:35645
    P
    		unrar-3.80.2-2.8 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35604
    P
    		libsoup-2_4-1-2.28.2-0.1.151 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35750
    P
    		libicu-32bit-4.0-7.24.11 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35706
    P
    		ghostscript-fonts-other-8.62-32.28.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35678
    P
    		coolkey-1.1.0-22.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35639
    P
    		star-1.5final-28.19 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35590
    P
    		libmusicbrainz4-2.1.5-5.18 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35531
    P
    		coolkey-1.1.0-22.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:26977
    P
    		libupsclient1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33237
    P
    		ppp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29584
    P
    		Security update for Apache2
    2020-12-01
    oval:org.opensuse.security:def:26966
    P
    		libpulse-browse0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33180
    P
    		libsndfile on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29545
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26965
    P
    		libproxy0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34966
    P
    		Security update for gcc43 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34922
    P
    		Security update for evolution-data-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32871
    P
    		gmime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29289
    P
    		Security update for Real Time Linux Kernel
    2020-12-01
    oval:org.opensuse.security:def:34896
    P
    		Security update for cyrus-imapd (Low)
    2020-12-01
    oval:org.opensuse.security:def:32860
    P
    		findutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29204
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34857
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:31593
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32859
    P
    		file-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29147
    P
    		Security update for kvm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34808
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31555
    P
    		Security update for sqlite3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29061
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:34750
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:30917
    P
    		Security update for gd
    2020-12-01
    oval:org.opensuse.security:def:30873
    P
    		Security update for expat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30853
    P
    		Security update for djvulibre (Low)
    2020-12-01
    oval:org.opensuse.security:def:28850
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:30814
    P
    		Security update for cloud-init (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28849
    P
    		Security update for xalan-j2
    2020-12-01
    oval:org.opensuse.security:def:34346
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:30765
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34210
    P
    		Security update for perl-XML-LibXML (Important)
    2020-12-01
    oval:org.opensuse.security:def:30710
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:34126
    P
    		Security update for nmap (Important)
    2020-12-01
    oval:org.opensuse.security:def:30555
    P
    		Security update for PostgreSQL
    2020-12-01
    oval:org.opensuse.security:def:34115
    P
    		Security update for nagios-nrpe (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30468
    P
    		Security update for apache2-mod_nss (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32378
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34114
    P
    		Security update for nagios (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30411
    P
    		Security update for xorg-x11-libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32339
    P
    		Security update for shim (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30322
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35371
    P
    		Security update for netpbm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35224
    P
    		Security update for liblouis (Low)
    2020-12-01
    oval:org.opensuse.security:def:31596
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28414
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35123
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31547
    P
    		Security update for sblim-sfcb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28379
    P
    		Security update for ruby (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34987
    P
    		Security update for giflib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31491
    P
    		Security update for Python
    2020-12-01
    oval:org.opensuse.security:def:27741
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:34903
    P
    		Security update for dhcpcd (Important)
    2020-12-01
    oval:org.opensuse.security:def:27697
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-01
    oval:org.opensuse.security:def:34892
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27683
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:34373
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34891
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:27644
    P
    		Security update for libtiff
    2020-12-01
    oval:org.opensuse.security:def:27595
    P
    		Security update for ImageMagick
    2020-12-01
    oval:org.opensuse.security:def:30967
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27542
    P
    		python-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30893
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:27391
    P
    		e2fsprogs-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30882
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:27307
    P
    		tcpdump on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33588
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:30321
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30881
    P
    		Security update for file-roller (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27250
    P
    		ofed on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33539
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:27169
    P
    		libFLAC++6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33482
    P
    		Security update for OpenSC
    2020-12-01
    oval:org.opensuse.security:def:29646
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27041
    P
    		t1lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33325
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29602
    P
    		Security update for avahi (Moderate)
    2020-12-01
    oval:com.ubuntu.artful:def:20165315000
    V
    		CVE-2016-5315 on Ubuntu 17.10 (artful) - medium.
    2017-03-07
    oval:com.ubuntu.precise:def:20165315000
    V
    		CVE-2016-5315 on Ubuntu 12.04 LTS (precise) - medium.
    2017-03-07
    oval:com.ubuntu.trusty:def:20165315000
    V
    		CVE-2016-5315 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-03-07
    oval:com.ubuntu.xenial:def:201653150000000
    V
    		CVE-2016-5315 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-03-07
    oval:com.ubuntu.xenial:def:20165315000
    V
    		CVE-2016-5315 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-03-07
    oval:org.cisecurity:def:1756
    P
    		DSA-3762-1 -- tiff -- security update
    2017-02-24
    BACK
    libtiff libtiff *
    debian debian linux 8.0
    libtiff libtiff 4.0.6