kritik
CVE-2016-9535
libtiff: Predictor heap-buffer-overflow
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Amazon (orta), Oracle (orta), Ubuntu (orta).
Açıklama
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | compat-libtiff3, compat-libtiff3-debuginfo, libtiff ve 3 tane daha | 3.9.4-21.15.amzn1 ve 1 tane daha |
| debian 11 | tiff | 4.0.7-1 |
| debian 12 | tiff | 4.0.7-1 |
| debian 13 | tiff | 4.0.7-1 |
| debian 14 | tiff | 4.0.7-1 |
| debian 7 | tiff, tiff3 | 4.0.2-6+deb7u9 ve 1 tane daha |
| debian 8 | tiff | 4.0.3-12.3+deb8u3 |
| echo | tiff | 4.0.7-1 |
| Oracle Linux 6 | libtiff, libtiff-devel, libtiff-static | 3.9.4-21.el6_8 |
| Oracle Linux 7 | libtiff, libtiff-devel, libtiff-static ve 1 tane daha | 4.0.3-27.el7_3 |
| Red Hat | compat-libtiff3 | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-tiff | 4.0.7-1 |
19 kaynaktaki 30 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | compat-libtiff3 | 3.9.4-21.15.amzn1 |
| amazon linux 1 | compat-libtiff3-debuginfo | 3.9.4-21.15.amzn1 |
| amazon linux 1 | libtiff | 4.0.3-27.29.amzn1 |
| amazon linux 1 | libtiff-debuginfo | 4.0.3-27.29.amzn1 |
| amazon linux 1 | libtiff-devel | 4.0.3-27.29.amzn1 |
| amazon linux 1 | libtiff-static | 4.0.3-27.29.amzn1 |
| debian 11 | tiff | 4.0.7-1 |
| debian 12 | tiff | 4.0.7-1 |
| debian 13 | tiff | 4.0.7-1 |
| debian 14 | tiff | 4.0.7-1 |
| debian 7 | tiff | 4.0.2-6+deb7u9 |
| debian 7 | tiff3 | 3.9.6-11+deb7u4 |
| debian 8 | tiff | 4.0.3-12.3+deb8u3 |
| echo | tiff | 4.0.7-1 |
| Oracle Linux 6 | libtiff | 3.9.4-21.el6_8 |
| Oracle Linux 6 | libtiff-devel | 3.9.4-21.el6_8 |
| Oracle Linux 6 | libtiff-static | 3.9.4-21.el6_8 |
| Oracle Linux 7 | libtiff | 4.0.3-27.el7_3 |
| Oracle Linux 7 | libtiff-devel | 4.0.3-27.el7_3 |
| Oracle Linux 7 | libtiff-static | 4.0.3-27.el7_3 |
| Oracle Linux 7 | libtiff-tools | 4.0.3-27.el7_3 |
| Red Hat | compat-libtiff3 | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-tiff | 4.0.7-1 |
| root.io debian 12 | rootio-tiff | 4.0.7-1 |
| root.io debian 13 | rootio-tiff | 4.0.7-1 |
| ubuntu 14.04 | tiff | 4.0.3-7ubuntu0.6 |
| ubuntu 14.04-ESM | tiff | 4.0.3-7ubuntu0.6 |
| ubuntu 16.04 | tiff | 4.0.6-1ubuntu0.1 |
| ubuntu 16.04-ESM | tiff | 4.0.6-1ubuntu0.1 |
| ubuntu 16.10 | tiff | 4.0.6-2ubuntu0.1 |
Referanslar
- http://rhn.redhat.com/errata/RHSA-2017-0225.html
- http://www.debian.org/security/2017/dsa-3844
- http://www.securityfocus.com/bid/94484
- http://www.securityfocus.com/bid/94744
- https://access.redhat.com/security/cve/CVE-2016-9535
- https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1
- https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33
- https://linux.oracle.com/cve/CVE-2016-9535.html