Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 12 Apr 2016 07:19:43 +0000
From: 张开翔 <>
To: "" <>
Subject: CVE-2016-3990 : out-of-bounds write in horizontalDifference8() in
 tiffcp tool



Product: libtiff

Affected Versions: <= 4.0.6

CVE ID: CVE-2016-3990

Tested system: CentOS Linux release 7.1.1503 64bit

Vulnerability Type: out-of-bounds write
Vendor URL:

Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360



An out-of-bounds write flaw was found in libtiff v4.0.6 when using tiffcp command to handle malicious tiff file. The vulnerability exist in function horizontalDifference8()

without checking the buffer length.An attacker could control the head data of next heap which contains pre_size field and size filed to result in DoS or may command execution..

Source info

1082           wp += n + stride - 1;     /* point to last one */
1083           ip += n + stride - 1;       /* point to last one */
1084           n -= stride;
1085           while (n > 0) {
1086              REPEAT(stride, wp[0] = CLAMP(ip[0]);
1087                            wp[stride] -= wp[0];
1088                            wp[stride] &= mask;
1089                            wp--; ip--)
1090              n -= stride;
1091           }
1092           REPEAT(stride, wp[0] = CLAMP(ip[0]); wp--; ip--)

Debug info

gdb �Cargs ./tiffcp poc.tif src1.tif tmpout.tif
--- --- ---
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6f943b9 in _int_free () from /lib64/
(gdb) bt
#0  0x00007ffff6f943b9 in _int_free () from /lib64/
#1  0x00007ffff7a52721 in TIFFClose (tif=tif@...ry=0x625930) at tif_close.c:128
#2  0x0000000000405160 in main (argc=3, argv=0x7fffffffe3b8) at tiffcp.c:305
(gdb) x/2xg 0x625930-0x10
0x625920:        0x00000000000000f0      0x0000000000000450
(gdb) x/2xg 0x625930-0x10-0xf0
0x625830:       0x0000000000040004     0x0000000003370424


Thank you!

Best Regards,

Kaixiang Zhang
--- ---

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.