CVE-2016-9535 MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office | < 16.0.19426.20044 | 16.0.19426.20044 |
| Microsoft windows 10 1809 | < 10.0.17763.7919 | 10.0.17763.7919 |
| Microsoft Windows Server 2019 | < 10.0.17763.7919 | 10.0.17763.7919 |
| Microsoft Windows Server 2022 | < 10.0.20348.4294 | 10.0.20348.4294 |
| Microsoft windows 10 21h2 | < 10.0.19044.6456 | 10.0.19044.6456 |
| Microsoft windows 11 22h2 | < 10.0.22621.6060 | 10.0.22621.6060 |
| Microsoft windows 10 22h2 | < 10.0.19045.6456 | 10.0.19045.6456 |
| Microsoft Windows Server 2025 | < 10.0.26100.6899 | 10.0.26100.6899 |
| Microsoft windows 11 25h2 | < 10.0.26200.6899 | 10.0.26200.6899 |
| Microsoft windows 11 23h2 | < 10.0.22631.6060 | 10.0.22631.6060 |
| Microsoft windows server 23h2 | < 10.0.25398.1913 | 10.0.25398.1913 |
| Microsoft windows 11 24h2 | < 10.0.26100.6899 | 10.0.26100.6899 |
| Microsoft windows 10 1507 | < 10.0.10240.21161 | 10.0.10240.21161 |
| Microsoft windows 10 1607 | < 10.0.14393.8519 | 10.0.14393.8519 |
| Microsoft Windows Server 2016 | < 10.0.14393.8519 | 10.0.14393.8519 |
| Microsoft windows server 2008 sp2 | < 6.0.6003.23571 | 6.0.6003.23571 |
| Microsoft windows server 2008 r2 | < 6.1.7601.27974 | 6.1.7601.27974 |
| Microsoft Windows Server 2012 | < 6.2.9200.25722 | 6.2.9200.25722 |
| Microsoft Windows Server 2012 R2 | < 6.3.9600.22824 | 6.3.9600.22824 |
| debian/tiff(Debian:12) | < 4.0.7-1 | 4.0.7-1 |
| debian/tiff(Debian:13) | < 4.0.7-1 | 4.0.7-1 |
| debian/tiff(Debian:14) | < 4.0.7-1 | 4.0.7-1 |
| libtiff | = 4.0.6 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes patch
- Release Notes vendor-advisory
- KB5066586 patch
- KB5066586 vendor-advisory
- KB5066782 patch
- KB5066782 vendor-advisory
- KB5066791 patch
- KB5066791 vendor-advisory
- KB5066793 patch
- KB5066793 vendor-advisory
- KB5066835 patch
- KB5066835 vendor-advisory
- KB5066780 patch
- KB5066780 vendor-advisory
- KB5066837 patch
- KB5066837 vendor-advisory
- KB5066836 patch
- KB5066836 vendor-advisory
- KB5066874 patch
- KB5066874 vendor-advisory
- KB5066877 patch
- KB5066877 vendor-advisory
- KB5066872 patch
- KB5066872 vendor-advisory
- KB5066876 patch
- KB5066876 vendor-advisory
- KB5066875 patch
- KB5066875 vendor-advisory
- KB5066873 patch
- KB5066873 vendor-advisory
- Debian Security Tracker CVE-2016-9535 vendor-advisory
- RHSA-2017:0225 vendor-advisory
- DSA-3844 vendor-advisory
- 94484 third-party-advisory vdb-entry
- 94744 vdb-entry
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory