// For flags

CVE-2006-3462

Multiple libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.

Desbordamiento de búfer basado en pila en el descodificador NeXT RLE en la librería TIFF (libtiff) anterior a 3.8.2 podría permitir a atacantes dependientes de contexto ejecutar código de su elección mediante vectores no especificados que implican la descodificación de imágenes RLE grandes.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-07-10 CVE Reserved
  • 2006-08-03 CVE Published
  • 2023-06-06 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (49)
URL Tag Source
http://docs.info.apple.com/article.html?artnum=304063 X_refsource_misc
http://securitytracker.com/id?1016628 Vdb Entry
http://securitytracker.com/id?1016671 Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm X_refsource_confirm
http://www.osvdb.org/27726 Vdb Entry
http://www.securityfocus.com/bid/19282 Vdb Entry
http://www.securityfocus.com/bid/19289 Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA06-214A.html Third Party Advisory
https://issues.rpath.com/browse/RPL-558 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11301 Signature
URL Date SRC
URL Date SRC
http://www.debian.org/security/2006/dsa-1137 2017-10-11
URL Date SRC
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P 2017-10-11
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc 2017-10-11
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html 2017-10-11
http://lwn.net/Alerts/194228 2017-10-11
http://secunia.com/advisories/21253 2017-10-11
http://secunia.com/advisories/21274 2017-10-11
http://secunia.com/advisories/21290 2017-10-11
http://secunia.com/advisories/21304 2017-10-11
http://secunia.com/advisories/21319 2017-10-11
http://secunia.com/advisories/21334 2017-10-11
http://secunia.com/advisories/21338 2017-10-11
http://secunia.com/advisories/21346 2017-10-11
http://secunia.com/advisories/21370 2017-10-11
http://secunia.com/advisories/21392 2017-10-11
http://secunia.com/advisories/21501 2017-10-11
http://secunia.com/advisories/21537 2017-10-11
http://secunia.com/advisories/21598 2017-10-11
http://secunia.com/advisories/21632 2017-10-11
http://secunia.com/advisories/22036 2017-10-11
http://secunia.com/advisories/27181 2017-10-11
http://secunia.com/advisories/27222 2017-10-11
http://secunia.com/advisories/27832 2017-10-11
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600 2017-10-11
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1 2017-10-11
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1 2017-10-11
http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml 2017-10-11
http://www.mandriva.com/security/advisories?name=MDKSA-2006:136 2017-10-11
http://www.mandriva.com/security/advisories?name=MDKSA-2006:137 2017-10-11
http://www.novell.com/linux/security/advisories/2006_44_libtiff.html 2017-10-11
http://www.redhat.com/support/errata/RHSA-2006-0603.html 2017-10-11
http://www.redhat.com/support/errata/RHSA-2006-0648.html 2017-10-11
http://www.ubuntu.com/usn/usn-330-1 2017-10-11
http://www.vupen.com/english/advisories/2006/3101 2017-10-11
http://www.vupen.com/english/advisories/2006/3105 2017-10-11
http://www.vupen.com/english/advisories/2007/3486 2017-10-11
http://www.vupen.com/english/advisories/2007/4034 2017-10-11
https://access.redhat.com/security/cve/CVE-2006-3462 2006-08-28
https://bugzilla.redhat.com/show_bug.cgi?id=199111 2006-08-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Libtiff
Search vendor "Libtiff"
 Libtiff
Search vendor "Libtiff" for product "Libtiff"
 <= 3.8.1
Search vendor "Libtiff" for product "Libtiff" and version " <= 3.8.1"
-
Affected