CVE-2015-8668

Опубликовано: 08 янв. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

Ссылки

http://packetstormsecurity.com/files/135080/libtiff-4.0.6-Heap-Overflow.html
Exploit
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1546.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1547.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Third Party Advisory
http://www.securityfocus.com/archive/1/537208/100/0/threaded
Broken Link
VDB Entry
https://security.gentoo.org/glsa/201701-16
Third Party Advisory
http://packetstormsecurity.com/files/135080/libtiff-4.0.6-Heap-Overflow.html
Exploit
Third Party Advisory
VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1546.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1547.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Third Party Advisory
http://www.securityfocus.com/archive/1/537208/100/0/threaded
Broken Link
VDB Entry
https://security.gentoo.org/glsa/201701-16
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

Версия до 4.0.6 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:vm_server:3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:vm_server:3.4:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.07584

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2015-8668

CVSS3: 9.8

ubuntu

больше 9 лет назад

CVE-2015-8668

CVSS3: 3.3

redhat

больше 9 лет назад

CVE-2015-8668

CVSS3: 9.8

debian

больше 9 лет назад

Heap-based buffer overflow in the PackBitsPreEncode function in tif_pa ...

GHSA-mgjx-j5p2-m66r

CVSS3: 9.8

github

больше 3 лет назад

SUSE-SU-2024:0915-1

suse-cvrf

больше 1 года назад

Security update for tiff

EPSS

Процентиль: 91%

0.07584

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-787