Vulnerability Spotlight: LibTIFF Issues Lead To Code Execution
Summary: Cisco Talos disclosed three LibTIFF vulnerabilities (TALOS-2016-0187, TALOS-2016-0190 and TALOS-2016-0205) that let an attacker who tricks a user into processing a malformed TIFF document achieve remote code execution. CVE-2016-8331, a type confusion in FAX IFD entry parsing involving the BadFaxLines field, remained unpatched as of the post, while patches for CVE-2016-5652 and CVE-2016-5875 were available only from the LibTIFF GIT repository.
What you should know: One of the three flaws, CVE-2016-8331, had no patch at disclosure, and the other two required pulling fixes from a GIT repository rather than an official LibTIFF release - leaving anyone running the standard build, including the default-installed tiff2pdf tool, exposed to a crafted file.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-5652CVE-2016-5875CVE-2016-8331
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026