Vulnerability Details : CVE-2016-5652
Potential exploit
An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.
Vulnerability category: OverflowExecute code
Products affected by CVE-2016-5652
- cpe:2.3:a:libtiff:libtiff:4.0.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5652
1.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5652
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.0
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST |
CWE ids for CVE-2016-5652
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5652
-
http://www.talosintelligence.com/reports/TALOS-2016-0187/
TALOS-2016-0187 || Cisco Talos Intelligence Group - Comprehensive Threat IntelligenceExploit;Technical Description;Third Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201701-16
libTIFF: Multiple vulnerabilities (GLSA 201701-16) — Gentoo security
-
http://www.securityfocus.com/bid/93902
LibTIFF CVE-2016-5652 Heap Buffer Overflow Vulnerability
-
http://rhn.redhat.com/errata/RHSA-2017-0225.html
RHSA-2017:0225 - Security Advisory - Red Hat Customer Portal
-
http://www.debian.org/security/2017/dsa-3762
Debian -- Security Information -- DSA-3762-1 tiff
Jump to