CVE-2016-5317: libtiff
CVSS: 6.5v3.0MediumModified
AliasesALPINE-CVE-2016-5317UBUNTU-CVE-2016-5317DEBIAN-CVE-2016-5317
Published 20-01-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-5317 is a medium (CVSS 6.5) vulnerability in libtiff. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 79.8% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
1.95%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 20-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
-0.02 pp
From 1.96% on 18-09-2026
18-09-202618-10-2026
EPSS score1.95%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- tiff< 4.0.7-r0
Debian1 product
- tiff< 4.0.6-2
Libtiff1 product
- libtiff4.0.6
Opensuse1 product
- opensuseEOL13.1 | 13.2
Opensuse_project1 product
- leap42.1
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.6 | < 4.0.6-1ubuntu0.1
6 vendors · 6 products
References
14 links- lists.opensuse.org/opensuse-updates/2016-09/msg00060.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-07/msg00087.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-09/msg00090.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
