CVE-2016-5323 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Low
Remote	Yes
Type	Denial of service
Description	When using the tiffcrop command and a crafted TIFF image, the function _TIFFFax3fill() runs without checking the value of the divisor and causes a divide by zero flaw. Attackers can exploit this issue to cause a denial of service.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-86	lib32-libtiff	4.0.6-2	4.0.7-1	Critical	Fixed
AVG-85	libtiff	4.0.6-2	4.0.7-1	Critical	Fixed

Date	Advisory	Group	Package	Severity	Type
25 Nov 2016	ASA-201611-27	AVG-86	lib32-libtiff	Critical	multiple issues
25 Nov 2016	ASA-201611-26	AVG-85	libtiff	Critical	multiple issues

References
http://seclists.org/oss-sec/2016/q2/548 http://bugzilla.maptools.org/show_bug.cgi?id=2559#c3

Notes
Reproducer http://bugzilla.maptools.org/attachment.cgi?id=659 FIXED: 2016-07-11 Even Rouault <even.rouault at spatialys.com> tools/tiffcrop.c: Avoid access outside of stack allocated array on a tiled separate TIFF with more than 8 samples per pixel. Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360 (CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)

Notes

Reproducer http://bugzilla.maptools.org/attachment.cgi?id=659

FIXED:
2016-07-11 Even Rouault <even.rouault at spatialys.com>
tools/tiffcrop.c: Avoid access outside of stack allocated array on a tiled separate TIFF with more than 8 samples per pixel.     
Reported by Kaixiang Zhang of the Cloud Security Team, Qihoo 360
(CVE-2016-5321 / CVE-2016-5323 , bugzilla #2558 / #2559)