Skip to content
OpenAdvisories
Critical USN-3212-1 39 CVEs

tiff vulnerabilities

Published Feb 27, 2017 · Updated Jun 1, 2026

Ecosystem: Ubuntu

Summary

It was discovered that LibTIFF incorrectly handled certain malformed
images. If a user or automated system were tricked into opening a specially
crafted image, a remote attacker could crash the application, leading to a
denial of service, or possibly execute arbitrary code with user privileges.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS tiff 4.0.3-7ubuntu0.6
Ubuntu · 16.04 LTS 16.04:LTS tiff 4.0.6-1ubuntu0.1

Vulnerabilities 39

  • Critical 9.8
    CVE-2016-9535

    tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or …

    tiff tiff Debian Ubuntu
  • High 8.8
    CVE-2017-5225

    LibTIFF version 4.0.7 is vulnerable to a heap buffer overflow in the tools/tiffcp resulting in DoS or code execution vi…

    tiff tiff tiff Debian Ubuntu Alpine
  • High 8.1
    CVE-2016-8331

    An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A cr…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-7554

    The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8668 EPSS 14%

    Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-10092

    Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-10093

    Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-10094

    Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attack…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3622

    The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-3623

    The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) b…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-3624

    The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of s…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-3632

    The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3658

    The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier all…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-3945

    Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3990

    Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-3991

    Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote at…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-5314

    Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers t…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5315

    The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of servic…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5316

    Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attacke…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5317

    Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlie…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5320 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2…

    tiff tiff Ubuntu Alpine
  • Unscored —
    CVE-2016-5321

    The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read an…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5322

    The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of servic…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-5323

    The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5652

    An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted T…

    LibTIFF LibTIFF tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-5875 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2…

    tiff tiff Ubuntu Alpine
  • Unscored —
    CVE-2016-6223

    The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to c…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9273

    tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9297

    The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds re…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9448

    The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer der…

    tiff tiff Ubuntu Alpine
  • Unscored —
    CVE-2016-9453

    The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bound…

    tiff tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9532

    Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attack…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9533

    tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 350…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9534

    tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc an…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9536

    tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9537

    tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 3509…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9538

    tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9539

    tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9540

    tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Repo…

    tiff tiff Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-7554
  • report
    https://ubuntu.com/security/CVE-2015-8668
  • report
    https://ubuntu.com/security/CVE-2016-3622
  • report
    https://ubuntu.com/security/CVE-2016-3623
  • report
    https://ubuntu.com/security/CVE-2016-3624
  • report
    https://ubuntu.com/security/CVE-2016-3632
  • report
    https://ubuntu.com/security/CVE-2016-3658
  • report
    https://ubuntu.com/security/CVE-2016-3945
  • report
    https://ubuntu.com/security/CVE-2016-3990
  • report
    https://ubuntu.com/security/CVE-2016-3991
  • report
    https://ubuntu.com/security/CVE-2016-5314
  • report
    https://ubuntu.com/security/CVE-2016-5315
  • report
    https://ubuntu.com/security/CVE-2016-5316
  • report
    https://ubuntu.com/security/CVE-2016-5317
  • report
    https://ubuntu.com/security/CVE-2016-5320
  • report
    https://ubuntu.com/security/CVE-2016-5321
  • report
    https://ubuntu.com/security/CVE-2016-5322
  • report
    https://ubuntu.com/security/CVE-2016-5323
  • report
    https://ubuntu.com/security/CVE-2016-5652
  • report
    https://ubuntu.com/security/CVE-2016-5875
  • report
    https://ubuntu.com/security/CVE-2016-6223
  • report
    https://ubuntu.com/security/CVE-2016-8331
  • report
    https://ubuntu.com/security/CVE-2016-9273
  • report
    https://ubuntu.com/security/CVE-2016-9297
  • report
    https://ubuntu.com/security/CVE-2016-9448
  • report
    https://ubuntu.com/security/CVE-2016-9453
  • report
    https://ubuntu.com/security/CVE-2016-9532
  • report
    https://ubuntu.com/security/CVE-2016-9533
  • report
    https://ubuntu.com/security/CVE-2016-9534
  • report
    https://ubuntu.com/security/CVE-2016-9535
  • report
    https://ubuntu.com/security/CVE-2016-9536
  • report
    https://ubuntu.com/security/CVE-2016-9537
  • report
    https://ubuntu.com/security/CVE-2016-9538
  • report
    https://ubuntu.com/security/CVE-2016-9539
  • report
    https://ubuntu.com/security/CVE-2016-9540
  • report
    https://ubuntu.com/security/CVE-2016-10092
  • report
    https://ubuntu.com/security/CVE-2016-10093
  • report
    https://ubuntu.com/security/CVE-2016-10094
  • report
    https://ubuntu.com/security/CVE-2017-5225