// For flags

CVE-2006-3460

Multiple libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream that is longer than the scan line size (TiffScanLineSize).

Desbordamiento de búfer basado en montón en el decodificador JPEG de la librería TIFF (libtiff) anterior a 3.8.2 permite a atacantes locales o remotos (dependiendo del contexto) provocar una denegación de servicio y posiblemente ejecutar código de su elección mediante un flujo JPEG codificado que es más largo que el tamaño de la línea de escaneo (TiffScanLineSize).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-07-10 CVE Reserved
  • 2006-08-03 CVE Published
  • 2023-06-06 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (43)
URL Tag Source
http://securitytracker.com/id?1016628 Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm X_refsource_confirm
http://www.securityfocus.com/bid/19288 Vdb Entry
http://www.securityfocus.com/bid/19289 Vdb Entry
https://issues.rpath.com/browse/RPL-558 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11265 Signature
URL Date SRC
URL Date SRC
http://www.debian.org/security/2006/dsa-1137 2017-10-11
URL Date SRC
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P 2017-10-11
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc 2017-10-11
http://lwn.net/Alerts/194228 2017-10-11
http://secunia.com/advisories/21274 2017-10-11
http://secunia.com/advisories/21290 2017-10-11
http://secunia.com/advisories/21304 2017-10-11
http://secunia.com/advisories/21319 2017-10-11
http://secunia.com/advisories/21334 2017-10-11
http://secunia.com/advisories/21338 2017-10-11
http://secunia.com/advisories/21346 2017-10-11
http://secunia.com/advisories/21370 2017-10-11
http://secunia.com/advisories/21392 2017-10-11
http://secunia.com/advisories/21501 2017-10-11
http://secunia.com/advisories/21537 2017-10-11
http://secunia.com/advisories/21598 2017-10-11
http://secunia.com/advisories/21632 2017-10-11
http://secunia.com/advisories/22036 2017-10-11
http://secunia.com/advisories/27181 2017-10-11
http://secunia.com/advisories/27222 2017-10-11
http://secunia.com/advisories/27832 2017-10-11
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600 2017-10-11
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1 2017-10-11
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1 2017-10-11
http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml 2017-10-11
http://www.mandriva.com/security/advisories?name=MDKSA-2006:136 2017-10-11
http://www.mandriva.com/security/advisories?name=MDKSA-2006:137 2017-10-11
http://www.novell.com/linux/security/advisories/2006_44_libtiff.html 2017-10-11
http://www.redhat.com/support/errata/RHSA-2006-0603.html 2017-10-11
http://www.redhat.com/support/errata/RHSA-2006-0648.html 2017-10-11
http://www.ubuntu.com/usn/usn-330-1 2017-10-11
http://www.vupen.com/english/advisories/2006/3101 2017-10-11
http://www.vupen.com/english/advisories/2006/3105 2017-10-11
http://www.vupen.com/english/advisories/2007/3486 2017-10-11
http://www.vupen.com/english/advisories/2007/4034 2017-10-11
https://access.redhat.com/security/cve/CVE-2006-3460 2006-08-28
https://bugzilla.redhat.com/show_bug.cgi?id=199111 2006-08-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Libtiff
Search vendor "Libtiff"
 Libtiff
Search vendor "Libtiff" for product "Libtiff"
 <= 3.8.1
Search vendor "Libtiff" for product "Libtiff" and version " <= 3.8.1"
-
Affected