CVE-2006-3463

Published: Aug 3, 2006Modified: Apr 16, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial of service via a large td_nstrips value, which triggers an infinite loop.

Affected (1)

Products: Libtiff: Libtiff

Libtiff

1 product

Libtiff

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Up to 3.8.1

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (78)

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://lwn.net/Alerts/194228/

Source: secalert@redhat.com

http://secunia.com/advisories/21274

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21290

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21304

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21319

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21334

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21338

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21346

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21370

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21392

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21501

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21537

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21598

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/21632

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/22036

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27181

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27222

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/27832

Source: secalert@redhat.com

Vendor Advisory

http://securitytracker.com/id?1016628

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1137

Source: secalert@redhat.com

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:136

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:137

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2006_44_libtiff.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0603.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0648.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/19284

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-330-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3105

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2007/3486

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2007/4034

Source: secalert@redhat.com

Vendor Advisory

https://issues.rpath.com/browse/RPL-558

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10639

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P (unsafe URL)