ByteOS Network

NVD Vulnerability Details :

CVE-2016-9535

Deferred

Source-cve@mitre.org

Published At-22 Nov, 2016 | 19:59

Updated At-12 Apr, 2025 | 10:46

tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

LibTIFF

>>libtiff>>4.0.6

cpe:2.3:a:libtiff:libtiff:4.0.6:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://rhn.redhat.com/errata/RHSA-2017-0225.html	cve@mitre.org	N/A
http://www.debian.org/security/2017/dsa-3844	cve@mitre.org	N/A
http://www.securityfocus.com/bid/94484	cve@mitre.org	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/94744	cve@mitre.org	N/A
https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1	cve@mitre.org	Issue Tracking Patch Third Party Advisory
https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33	cve@mitre.org	Issue Tracking Patch Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0225.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.debian.org/security/2017/dsa-3844	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/94484	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/94744	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Patch Third Party Advisory
https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Patch Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History