CVE-2016-3991

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.maptools.org/show_bug.cgi?id=2543Issue Tracking
http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html
http://rhn.redhat.com/errata/RHSA-2016-1546.html
http://rhn.redhat.com/errata/RHSA-2016-1547.html
http://www.debian.org/security/2017/dsa-3762
http://www.openwall.com/lists/oss-security/2016/04/12/3Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/85996Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1326249Issue Tracking
https://security.gentoo.org/glsa/201701-16
http://bugzilla.maptools.org/show_bug.cgi?id=2543Issue Tracking
http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html
http://rhn.redhat.com/errata/RHSA-2016-1546.html
http://rhn.redhat.com/errata/RHSA-2016-1547.html
http://www.debian.org/security/2017/dsa-3762
http://www.openwall.com/lists/oss-security/2016/04/12/3Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/85996Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1326249Issue Tracking
https://security.gentoo.org/glsa/201701-16

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-39926.2cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic CVE-2016-39937.5Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of se CVE-2016-39948.2The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive informati CVE-2016-39957.5The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.CVE-2016-39965.5ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data vi CVE-2016-39977.5NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of servic CVE-2016-39988.1NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of s CVE-2016-39996.1Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web scri CVE-2016-40009.8Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.CVE-2016-40018.6Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configu CVE-2016-40029.8Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allow CVE-2016-40036.1Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when usin