Remote Yes

Type Arbitrary code execution

Description

An out-of-bounds write caused by a heap overflow when using tiffcrop tool. The vulnerability is located in the loadImage() function of tiffcrop.c. loadImage() will read the numbers of tiles by calling TIFFNumberOfTiles(). However, if the numbers of tiles is 0, loadImage() will still read tile data by calling readContigTilesIntoBuffer() from the image, regardless of the numbers. In that case, loadImage() will allocate 3 bytes of heap to store a tile data, and a heap overflow occurs if a tile data is beyond 3 bytes. This will cause denial of service or arbitrary code execution upon freeing the buffer.

AVG-86 lib32-libtiff 4.0.6-2 4.0.7-1 Critical Fixed

AVG-85 libtiff 4.0.6-2 4.0.7-1 Critical Fixed

25 Nov 2016 ASA-201611-27 AVG-86 lib32-libtiff Critical multiple issues

25 Nov 2016 ASA-201611-26 AVG-85 libtiff Critical multiple issues

http://bugzilla.maptools.org/show_bug.cgi?id=2543

Reproducer http://bugs.fi/media/afl/libtiff/CVE-2016-3991.tif