CVE-2016-5316

Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.

References

Affected packages

Git / github.com/vadz/libtiff

Affected ranges

Type: GIT
Repo: https://github.com/vadz/libtiff
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

8a37c8e244de3457283b54986d09a8db4d24381c

Affected versions

Other

Pre360

Release-

Release-3-7-0

Release-v3-5-

Release-v3-5-4

Release-v3-5-5

Release-v3-5-7

Release-v3-6-0

Release-v3-6-0beta2

Release-v3-6-1

Release-v3-7-0-alpha

Release-v3-7-0beta

Release-v3-7-0beta2

Release-v3-7-1

Release-v3-7-2

Release-v3-7-3

Release-v3-7-4

Release-v3-8-0

Release-v3-8-1

Release-v3-8-2

Release-v4-0-0

Release-v4-0-0alpha

Release-v4-0-0alpha4

Release-v4-0-0alpha5

Release-v4-0-0alpha6

Release-v4-0-0beta7

Release-v4-0-1

Release-v4-0-2

Release-v4-0-3

Release-v4-0-4

Release-v4-0-4beta

Release-v4-0-5

Release-v4-0-6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-5316.json"

Git / gitlab.com/libtiff/libtiff

Affected ranges

Type: GIT
Repo: https://gitlab.com/libtiff/libtiff
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

5612707c086cda76319552a0a2afeddcfa67d1b3

Affected versions

v3.*

v3.5.3

v3.5.4

v3.5.5

v3.5.7

v3.6.0

v3.6.0beta2

v3.6.1

v3.7.0

v3.7.0alpha

v3.7.0beta

v3.7.0beta2

v3.7.1

v3.7.2

v3.7.3

v3.7.4

v3.8.0

v3.8.1

v3.8.2

v4.*

v4.0.0

v4.0.0alpha

v4.0.0alpha4

v4.0.0alpha5

v4.0.0alpha6

v4.0.0beta7

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.0.4beta

v4.0.5

v4.0.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-5316.json"