Evil-DB LogoEvil-DB
← All CVEs

CVE-2006-2656

high · 7.5

Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.

7.5
CVSS
14.4%
EPSS (exploit prob.)
96th
EPSS percentile
2006-05-30
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
libtifflibtiff<= 3.8.2
libtifflibtiff3.4
libtifflibtiff3.5.1
libtifflibtiff3.5.2
libtifflibtiff3.5.3
libtifflibtiff3.5.4
libtifflibtiff3.5.5
libtifflibtiff3.5.6
libtifflibtiff3.5.7
libtifflibtiff3.6.0
libtifflibtiff3.6.1
libtifflibtiff3.7.0
libtifflibtiff3.7.1
libtifflibtiff3.8.0
libtifflibtiff3.8.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2006-2656