CVE-2016-3945

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.maptools.org/show_bug.cgi?id=2545Issue Tracking
http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html
http://rhn.redhat.com/errata/RHSA-2016-1546.html
http://rhn.redhat.com/errata/RHSA-2016-1547.html
http://www.debian.org/security/2017/dsa-3762
http://www.openwall.com/lists/oss-security/2016/04/08/6Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/85960Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1325093Issue Tracking
https://security.gentoo.org/glsa/201701-16
http://bugzilla.maptools.org/show_bug.cgi?id=2545Issue Tracking
http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html
http://rhn.redhat.com/errata/RHSA-2016-1546.html
http://rhn.redhat.com/errata/RHSA-2016-1547.html
http://www.debian.org/security/2017/dsa-3762
http://www.openwall.com/lists/oss-security/2016/04/08/6Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/85960Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1325093Issue Tracking
https://security.gentoo.org/glsa/201701-16

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-39467.8SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Secur CVE-2016-39478.2Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 al CVE-2016-39487.5Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service CVE-2016-39497.5Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and SIMATIC S7-300 Profinet-disabled CPU devices with firmwa CVE-2016-39506.5Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via cra CVE-2016-39514.6Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denia CVE-2016-39527.8web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request CVE-2016-39539.8The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a har CVE-2016-39545.5web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.CVE-2016-39559.8The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial CVE-2016-39567.5The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before CVE-2016-39579.8The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, w