CVE-2016-3991

Source
Severity High
Remote Yes
Type Arbitrary code execution
Description
An out-of-bounds write caused by a heap overflow when using tiffcrop tool. The vulnerability is located in the loadImage() function of tiffcrop.c. loadImage() will read the numbers of tiles by calling TIFFNumberOfTiles(). However, if the numbers of tiles is 0, loadImage() will still read tile data by calling readContigTilesIntoBuffer() from the image, regardless of the numbers. In that case, loadImage() will allocate 3 bytes of heap to store a tile data, and a heap overflow occurs if a tile data is beyond 3 bytes. This will cause denial of service or arbitrary code execution upon freeing the buffer.
Group Package Affected Fixed Severity Status Ticket
AVG-86 lib32-libtiff 4.0.6-2 4.0.7-1 Critical Fixed
AVG-85 libtiff 4.0.6-2 4.0.7-1 Critical Fixed
Date Advisory Group Package Severity Description
25 Nov 2016 ASA-201611-27 AVG-86 lib32-libtiff Critical multiple issues
25 Nov 2016 ASA-201611-26 AVG-85 libtiff Critical multiple issues
References
http://bugzilla.maptools.org/show_bug.cgi?id=2543
Notes
Reproducer http://bugs.fi/media/afl/libtiff/CVE-2016-3991.tif