CVE-2016-9453

NameCVE-2016-9453
DescriptionThe t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3762-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tiff (PTS)bullseye (security), bullseye4.2.0-1+deb11u5fixed
bookworm, bookworm (security)4.5.0-6+deb12u1fixed
sid, trixie4.5.1+git230720-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tiffsourcewheezy4.0.2-6+deb7u7
tiffsourcejessie4.0.3-12.3+deb8u2DSA-3762-1
tiffsource(unstable)4.0.6-3
tiff3sourcewheezy(not affected)
tiff3source(unstable)(unfixed)

Notes

CVE-2016-9453 for wheezy fixed via CVE-2016-5652
[wheezy] - tiff3 <not-affected> (Tools not shipped by tiff3)
http://bugzilla.maptools.org/show_bug.cgi?id=2579
https://github.com/vadz/libtiff/commit/d2955714a4a0b8ca10941550cfbf64c7e111fbf1
For unstable this fix was included in the fix for TALOS-CAN-0187 / CVE-2016-5652
and included in patches/09-CVE-2016-5652.patch
Problem not reproducible in wheezy with 4.0.2-6+deb7u7, in jessie with 4.0.3-12.3+deb8u1, in both cases I get this output (but no segfault or error with valgrind):
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 1 (0x1) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 3 (0x3) encountered.
TIFFReadDirectory: IO error during reading of "BitsPerSample".
tiff2pdf: Can't open input file ./CVE-2016-9453.tiff for reading.

Search for package or bug name: Reporting problems