Vulnerability CVE-2016-5315

Vulnerability Name:

CVE-2016-5315 (CCN-114297)

Assigned:

2016-06-15

Published:

2016-06-15

Updated:

2017-03-08

Summary:

The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-125

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2016-5315

Source: CCN
Type: oss-sec Mailing List, Wed, 15 Jun 2016 02:31:43 +0000
CVE-2016-5315: libtiff 4.0.6 tif_dir.c: setByteArray() Read access violation

Source: DEBIAN
Type: Third Party Advisory
DSA-3762

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20160615 CVE-2016-5315: libtiff 4.0.6 tif_dir.c: setByteArray() Read access violation

Source: CCN
Type: LibTIFF Web site
LibTIFF - TIFF Library and Utilities

Source: BID
Type: Third Party Advisory, VDB Entry
91204

Source: CCN
Type: BID-91204
LibTIFF 'tif_dir.c' Out of Bounds Read Denial of Service Vulnerability

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1346694

Source: XF
Type: UNKNOWN
libtiff-cve20165315-dos(114297)

Source: GENTOO
Type: Third Party Advisory, VDB Entry
GLSA-201701-16

Vulnerable Configuration:

Configuration 1:

cpe:/a:libtiff:libtiff:*:*:*:*:*:*:*:* (Version <= 4.0.6)

Configuration 2:

cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:libtiff:libtiff:4.0.6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20165315	V	CVE-2016-5315	2022-05-20
oval:org.opensuse.security:def:29496	P	Security update for libsndfile (Important)	2022-01-05
oval:org.opensuse.security:def:35281	P	Security update for libvpx (Moderate)	2021-12-23
oval:org.opensuse.security:def:31335	P	Security update for xorg-x11-server (Important)	2021-12-20
oval:org.opensuse.security:def:30284	P	Security update for log4j (Important)	2021-12-17
oval:org.opensuse.security:def:34591	P	Security update for libarchive (Moderate)	2021-11-17
oval:org.opensuse.security:def:31701	P	Security update for pcre (Moderate)	2021-11-10
oval:org.opensuse.security:def:29442	P	Security update for binutils (Moderate)	2021-11-09
oval:org.opensuse.security:def:30116	P	Security update for python-PyYAML (Important)	2021-08-24
oval:org.opensuse.security:def:31248	P	Security update for cpio (Important)	2021-08-23
oval:org.opensuse.security:def:34501	P	Security update for fastjar (Low)	2021-08-06
oval:org.opensuse.security:def:33695	P	Security update for djvulibre (Important)	2021-08-05
oval:org.opensuse.security:def:31657	P	Security update for linuxptp (Important)	2021-07-21
oval:org.opensuse.security:def:30105	P	Security update for qemu (Moderate)	2021-07-21
oval:org.opensuse.security:def:30104	P	Security update for systemd (Important)	2021-07-21
oval:org.opensuse.security:def:32950	P	Security update for apache2 (Important)	2021-06-17
oval:org.opensuse.security:def:36430	P	krb5-devel-1.6.3-133.49.66.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36388	P	cyrus-imapd-devel-2.3.11-60.65.64.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:31191	P	Security update for gstreamer-plugins-bad (Important)	2021-06-07
oval:org.opensuse.security:def:34444	P	Security update for postgresql13 (Moderate)	2021-05-27
oval:org.opensuse.security:def:33651	P	Security update for xen (Important)	2021-05-19
oval:org.opensuse.security:def:30190	P	Security update for samba (Important)	2021-04-29
oval:org.opensuse.security:def:33085	P	Security update for postgresql-jdbc (Moderate)	2021-02-25
oval:org.opensuse.security:def:28930	P	Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP2) (Important)	2021-02-10
oval:org.opensuse.security:def:31635	P	Security update for java-1_7_1-ibm (Moderate)	2021-01-04
oval:org.opensuse.security:def:31099	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:33627	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:34333	P	Security update for openssl-1_1 (Important)	2020-12-10
oval:org.opensuse.security:def:28861	P	Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP2) (Important)	2020-12-07
oval:org.opensuse.security:def:35645	P	unrar-3.80.2-2.8 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35604	P	libsoup-2_4-1-2.28.2-0.1.151 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35750	P	libicu-32bit-4.0-7.24.11 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35706	P	ghostscript-fonts-other-8.62-32.28.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35678	P	coolkey-1.1.0-22.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35639	P	star-1.5final-28.19 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35590	P	libmusicbrainz4-2.1.5-5.18 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:35531	P	coolkey-1.1.0-22.24 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:26977	P	libupsclient1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33237	P	ppp on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29584	P	Security update for Apache2	2020-12-01
oval:org.opensuse.security:def:26966	P	libpulse-browse0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33180	P	libsndfile on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29545	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:26965	P	libproxy0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:34966	P	Security update for gcc43 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34922	P	Security update for evolution-data-server (Moderate)	2020-12-01
oval:org.opensuse.security:def:32871	P	gmime on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29289	P	Security update for Real Time Linux Kernel	2020-12-01
oval:org.opensuse.security:def:34896	P	Security update for cyrus-imapd (Low)	2020-12-01
oval:org.opensuse.security:def:32860	P	findutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29204	P	Security update for openssl (Moderate)	2020-12-01
oval:org.opensuse.security:def:34857	P	Security update for clamav (Important)	2020-12-01
oval:org.opensuse.security:def:31593	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:32859	P	file-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29147	P	Security update for kvm (Moderate)	2020-12-01
oval:org.opensuse.security:def:34808	P	Security update for apache2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:31555	P	Security update for sqlite3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:29061	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:34750	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:30917	P	Security update for gd	2020-12-01
oval:org.opensuse.security:def:30873	P	Security update for expat (Moderate)	2020-12-01
oval:org.opensuse.security:def:30853	P	Security update for djvulibre (Low)	2020-12-01
oval:org.opensuse.security:def:28850	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:30814	P	Security update for cloud-init (Moderate)	2020-12-01
oval:org.opensuse.security:def:28849	P	Security update for xalan-j2	2020-12-01
oval:org.opensuse.security:def:34346	P	Security update for squid3 (Important)	2020-12-01
oval:org.opensuse.security:def:30765	P	Security update for apport (Moderate)	2020-12-01
oval:org.opensuse.security:def:34210	P	Security update for perl-XML-LibXML (Important)	2020-12-01
oval:org.opensuse.security:def:30710	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:34126	P	Security update for nmap (Important)	2020-12-01
oval:org.opensuse.security:def:30555	P	Security update for PostgreSQL	2020-12-01
oval:org.opensuse.security:def:34115	P	Security update for nagios-nrpe (Moderate)	2020-12-01
oval:org.opensuse.security:def:30468	P	Security update for apache2-mod_nss (Moderate)	2020-12-01
oval:org.opensuse.security:def:32378	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:34114	P	Security update for nagios (Moderate)	2020-12-01
oval:org.opensuse.security:def:30411	P	Security update for xorg-x11-libX11 (Moderate)	2020-12-01
oval:org.opensuse.security:def:32339	P	Security update for shim (Moderate)	2020-12-01
oval:org.opensuse.security:def:30322	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:35371	P	Security update for netpbm (Moderate)	2020-12-01
oval:org.opensuse.security:def:35224	P	Security update for liblouis (Low)	2020-12-01
oval:org.opensuse.security:def:31596	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:28414	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:35123	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:31547	P	Security update for sblim-sfcb (Moderate)	2020-12-01
oval:org.opensuse.security:def:28379	P	Security update for ruby (Moderate)	2020-12-01
oval:org.opensuse.security:def:34987	P	Security update for giflib (Moderate)	2020-12-01
oval:org.opensuse.security:def:31491	P	Security update for Python	2020-12-01
oval:org.opensuse.security:def:27741	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:34903	P	Security update for dhcpcd (Important)	2020-12-01
oval:org.opensuse.security:def:27697	P	Security update for MozillaFirefox (Critical)	2020-12-01
oval:org.opensuse.security:def:34892	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:27683	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:34373	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:34891	P	Security update for curl (Important)	2020-12-01
oval:org.opensuse.security:def:27644	P	Security update for libtiff	2020-12-01
oval:org.opensuse.security:def:27595	P	Security update for ImageMagick	2020-12-01
oval:org.opensuse.security:def:30967	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:27542	P	python-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:30893	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:27391	P	e2fsprogs-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:30882	P	Security update for Mozilla Firefox	2020-12-01
oval:org.opensuse.security:def:27307	P	tcpdump on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33588	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:30321	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:30881	P	Security update for file-roller (Moderate)	2020-12-01
oval:org.opensuse.security:def:27250	P	ofed on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33539	P	Security update for ImageMagick (Important)	2020-12-01
oval:org.opensuse.security:def:27169	P	libFLAC++6 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33482	P	Security update for OpenSC	2020-12-01
oval:org.opensuse.security:def:29646	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:27041	P	t1lib on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33325	P	Security update for curl (Moderate)	2020-12-01
oval:org.opensuse.security:def:29602	P	Security update for avahi (Moderate)	2020-12-01
oval:com.ubuntu.artful:def:20165315000	V	CVE-2016-5315 on Ubuntu 17.10 (artful) - medium.	2017-03-07
oval:com.ubuntu.precise:def:20165315000	V	CVE-2016-5315 on Ubuntu 12.04 LTS (precise) - medium.	2017-03-07
oval:com.ubuntu.trusty:def:20165315000	V	CVE-2016-5315 on Ubuntu 14.04 LTS (trusty) - medium.	2017-03-07
oval:com.ubuntu.xenial:def:201653150000000	V	CVE-2016-5315 on Ubuntu 16.04 LTS (xenial) - medium.	2017-03-07
oval:com.ubuntu.xenial:def:20165315000	V	CVE-2016-5315 on Ubuntu 16.04 LTS (xenial) - medium.	2017-03-07
oval:org.cisecurity:def:1756	P	DSA-3762-1 -- tiff -- security update	2017-02-24

BACK