CVE-2016-5314

Name: CVE-2016-5314
Creator: NVD / NIST
Published: 2018-03-12T02:29:00.4+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 4.65%

Last modified Jun 17, 2026

CVE-2016-5314 is a vulnerability of currently unknown severity. Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.. EPSS estimates a 4.65% chance of exploitation in the next 30 days.

Description

Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.

Metrics

EPSS Probability

4.65%

90.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-787

Affected Software

Vendor	Product	Versions
Libtiff	Libtiff	<= 4.0.6
Opensuse	Leap	42.1
Opensuse	Opensuse	13.1
Opensuse	Opensuse	13.2
Redhat	Enterprise Linux	6.0
Redhat	Enterprise Linux	7.0
Debian	Debian Linux	8.0
Debian	Debian Linux	9.0

References

http://bugzilla.maptools.org/show_bug.cgi?id=2554Exploit, Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00060.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00090.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/15/1Mailing List
http://www.openwall.com/lists/oss-security/2016/06/15/9Mailing List
http://www.openwall.com/lists/oss-security/2016/06/30/3Mailing List
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
http://www.securityfocus.com/bid/91195Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91245Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1346687Issue Tracking, Third Party Advisory
https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2Patch
https://security.gentoo.org/glsa/201701-16Third Party Advisory
https://www.debian.org/security/2017/dsa-3762Third Party Advisory
http://bugzilla.maptools.org/show_bug.cgi?id=2554Exploit, Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00017.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-07/msg00087.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00060.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00090.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/15/1Mailing List
http://www.openwall.com/lists/oss-security/2016/06/15/9Mailing List
http://www.openwall.com/lists/oss-security/2016/06/30/3Mailing List
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
http://www.securityfocus.com/bid/91195Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91245Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1346687Issue Tracking, Third Party Advisory
https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2Patch
https://security.gentoo.org/glsa/201701-16Third Party Advisory
https://www.debian.org/security/2017/dsa-3762Third Party Advisory

Timeline

Published: Mar 12, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-5314?

How severe is CVE-2016-5314?

Severity scoring for CVE-2016-5314 is pending analysis. The EPSS model estimates a 4.65% probability of exploitation in the next 30 days.

How do I fix CVE-2016-5314?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-5314?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST