CVE-2016-9297 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Denial of service
Description	A buffer read overflow has been discovered in libtiff. The function TIFFFetchNormalTag() in libtiff/tif_dirread.c did not make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated leading to potential read outside the buffer in _TIFFPrintField().

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-86	lib32-libtiff	4.0.6-2	4.0.7-1	Critical	Fixed
AVG-85	libtiff	4.0.6-2	4.0.7-1	Critical	Fixed

Date	Advisory	Group	Package	Severity	Type
25 Nov 2016	ASA-201611-27	AVG-86	lib32-libtiff	Critical	multiple issues
25 Nov 2016	ASA-201611-26	AVG-85	libtiff	Critical	multiple issues

References
http://bugzilla.maptools.org/show_bug.cgi?id=2590 http://bugzilla.maptools.org/show_bug.cgi?id=2593 https://github.com/vadz/libtiff/commit/30c9234c7fd0dd5e8b1e83ad44370c875a0270ed https://github.com/vadz/libtiff/commit/89406285f318ffad27af4b200204394b2ee6ba5e

References

http://bugzilla.maptools.org/show_bug.cgi?id=2590
http://bugzilla.maptools.org/show_bug.cgi?id=2593
https://github.com/vadz/libtiff/commit/30c9234c7fd0dd5e8b1e83ad44370c875a0270ed
https://github.com/vadz/libtiff/commit/89406285f318ffad27af4b200204394b2ee6ba5e

Notes
FIXED: 2016-11-11 Even Rouault <even.rouault at spatialys.com> libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated, to avoid potential read outside buffer in _TIFFPrintField().

Notes

FIXED:
2016-11-11 Even Rouault <even.rouault at spatialys.com>
libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated, to avoid potential read outside buffer in _TIFFPrintField().