CVE-2006-3459

Published: Aug 3, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.

Affected (38)

Products: Libtiff: Libtiff

Libtiff

1 product

Libtiff

Configuration A

38 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Libtiff Libtiff	Up to 3.8.1
Libtiff Libtiff	Version 3.4
Libtiff Libtiff	Version 3.4 beta18
Libtiff Libtiff	Version 3.4 beta24
Libtiff Libtiff	Version 3.4 beta28
Libtiff Libtiff	Version 3.4 beta29
Libtiff Libtiff	Version 3.4 beta31
Libtiff Libtiff	Version 3.4 beta32
Libtiff Libtiff	Version 3.4 beta34
Libtiff Libtiff	Version 3.4 beta35
Libtiff Libtiff	Version 3.4 beta36
Libtiff Libtiff	Version 3.4 beta37
Libtiff Libtiff	Version 3.5.1
Libtiff Libtiff	Version 3.5.2
Libtiff Libtiff	Version 3.5.3
Libtiff Libtiff	Version 3.5.4
Libtiff Libtiff	Version 3.5.5
Libtiff Libtiff	Version 3.5.6
Libtiff Libtiff	Version 3.5.6 beta
Libtiff Libtiff	Version 3.5.7
Libtiff Libtiff	Version 3.5.7 alpha2
Libtiff Libtiff	Version 3.5.7 alpha3
Libtiff Libtiff	Version 3.5.7 alpha4
Libtiff Libtiff	Version 3.5.7 alpha
Libtiff Libtiff	Version 3.5.7 beta
Libtiff Libtiff	Version 3.6.0
Libtiff Libtiff	Version 3.6.0 beta2
Libtiff Libtiff	Version 3.6.0 beta
Libtiff Libtiff	Version 3.6.1
Libtiff Libtiff	Version 3.7.0
Libtiff Libtiff	Version 3.7.0 alpha
Libtiff Libtiff	Version 3.7.0 beta2
Libtiff Libtiff	Version 3.7.0 beta
Libtiff Libtiff	Version 3.7.1
Libtiff Libtiff	Version 3.7.2
Libtiff Libtiff	Version 3.7.3
Libtiff Libtiff	Version 3.7.4
Libtiff Libtiff	Version 3.8.0

Running on/with	Platform Versions
Adobe Acrobat Reader	Version 9.3.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (94)

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html

Source: secalert@redhat.com

http://lwn.net/Alerts/194228/

Source: secalert@redhat.com

http://secunia.com/advisories/21253

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21274

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21290

Source: secalert@redhat.com

http://secunia.com/advisories/21304

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21319

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21334

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21338

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21346

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21370

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21392

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21501

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21537

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21598

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21632

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22036

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27181

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27222

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27832

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/blog/76

Source: secalert@redhat.com

Vendor Advisory

http://securitytracker.com/id?1016628

Source: secalert@redhat.com

http://securitytracker.com/id?1016671

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1137

Source: secalert@redhat.com

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:136

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:137

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_44_libtiff.html

Source: secalert@redhat.com

http://www.osvdb.org/27723

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0603.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0648.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/19283

Source: secalert@redhat.com

http://www.securityfocus.com/bid/19289

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-330-1

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA06-214A.html

Source: secalert@redhat.com

US Government Resource

http://www.vupen.com/english/advisories/2006/3101

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3105

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2007/3486

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2007/4034

Source: secalert@redhat.com

Vendor Advisory

https://issues.rpath.com/browse/RPL-558

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11497

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P (unsafe URL)