CVE-2016-3186

Published: 19 April 2016

Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file.

Notes

upstream removed the gif2tiff utility in 4.0.7
patch in redhat bug https://bugzilla.redhat.com/show_bug.cgi?id=1319666#c6
we will not be fixing this issue in precise/esm

Priority

Medium

CVSS 3 base score: 6.2

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3186
• http://www.openwall.com/lists/oss-security/2016/03/30/2
• https://ubuntu.com/security/notices/USN-3606-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1319666
• https://bugzilla.redhat.com/show_bug.cgi?id=1319503
• http://bugzilla.maptools.org/show_bug.cgi?id=2536
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819972