CVE-2016-9535
Fixed in a distro release EPSS 5%CVSS 9.8
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
Products: libtiff
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | lib32-libtiff | 4.0.7-1 |
| Arch Linux | libtiff | 4.0.7-1 |
| Debian 12 | tiff | 4.0.7-1 |
| Debian 13 | tiff | 4.0.7-1 |
| Debian 14 | tiff | 4.0.7-1 |
| Debian 7 | tiff | 4.0.2-6+deb7u9 |
| Debian 7 | tiff3 | 3.9.6-11+deb7u4 |
| Debian 8 | tiff | 4.0.3-12.3+deb8u3 |
| Red Hat Enterprise Linux 6 | libtiff | 0:3.9.4-21.el6_8 |
| Red Hat Enterprise Linux 6 | libtiff-debuginfo | 0:3.9.4-21.el6_8 |
| Red Hat Enterprise Linux 6 | libtiff-devel | 0:3.9.4-21.el6_8 |
| Red Hat Enterprise Linux 6 | libtiff-static | 0:3.9.4-21.el6_8 |
| Red Hat Enterprise Linux 7 | libtiff | 0:4.0.3-27.el7_3 |
| Red Hat Enterprise Linux 7 | libtiff-debuginfo | 0:4.0.3-27.el7_3 |
| Red Hat Enterprise Linux 7 | libtiff-devel | 0:4.0.3-27.el7_3 |
| Red Hat Enterprise Linux 7 | libtiff-static | 0:4.0.3-27.el7_3 |
| Red Hat Enterprise Linux 7 | libtiff-tools | 0:4.0.3-27.el7_3 |
| SUSE Linux Enterprise Server 11 SP4 | tiff | 3.8.2-141.169.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | tiff | 3.8.2-141.169.9.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | tiff | 3.8.2-141.169.9.1 |
| Ubuntu 14.04 LTS | tiff | 4.0.3-7ubuntu0.6 |
| Ubuntu 16.04 LTS | tiff | 4.0.6-1ubuntu0.1 |