CVE-2016-8331

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	LibTIFF 4.0.6	LibTIFF 4.0.6

References

http://www.securityfocus.com/bid/93898Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0190/Exploit, Technical Description, Third Party Advisory
https://security.gentoo.org/glsa/201701-16
http://www.securityfocus.com/bid/93898Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0190/Exploit, Technical Description, Third Party Advisory
https://security.gentoo.org/glsa/201701-16

Timeline

Published: Oct 28, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-83327.8A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerabilit CVE-2016-83337.8An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus version 6.6.04 A spec CVE-2016-83343.3A large out-of-bounds read on the heap vulnerability in Foxit PDF Reader can potentially be abused for information disclosure. Combined with CVE-2016-83357.8An exploitable stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus Version 6.6.04 (Sep 7 2012) NK CVE-2016-83399.8A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulne CVE-2016-83419.8An issue was discovered in Ecava IntegraXor Version 5.0.413.0. The Ecava IntegraXor web server has parameters that are vulnerable to SQL inj CVE-2016-83437.5Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors.CVE-2016-83443.7An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Re CVE-2016-83467.5An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, CVE-2016-83479.8An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. WDC does not limit authentication attempts th CVE-2016-83489.8An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious in CVE-2016-83506.3An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E121