CVE-2018-16335

newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.

• CWE-787

• http://bugzilla.maptools.org/show_bug.cgi?id=2809Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4349Third Party Advisory
• http://bugzilla.maptools.org/show_bug.cgi?id=2809Issue Tracking, Patch, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4349Third Party Advisory

Published

Sep 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1633IBM Informix Dynamic Server Enterprise Edition 12.1 could al…6.7
• CVE-2018-16330Pandao Editor.md 1.5.0 allows XSS via crafted attributes of …
• CVE-2018-16331admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to c…
• CVE-2018-16332An issue was discovered in iCMS 7.0.9. There is an admincp.p…
• CVE-2018-16333An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V1…
• CVE-2018-16334An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN a…
• CVE-2018-16336Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allo…
• CVE-2018-16337An issue was discovered in Cscms V4.1.8. There is a CSRF vul…
• CVE-2018-16338An issue was discovered in AuraCMS 2.3. There is a CSRF vuln…
• CVE-2018-16339An issue was discovered in EmpireCMS 7.0. There is a CSRF vu…
• CVE-2018-1634IBM Informix Dynamic Server Enterprise Edition 12.1 could al…6.7
• CVE-2018-16342ShowDoc v1.8.0 has XSS via a new page.