CVE-2006-3462
Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.32% probability · 93th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- libtiff/libtiff
- Source
- secalert@redhat.com
EPSS 5.3% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P
- ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
- http://docs.info.apple.com/article.html?artnum=304063
- http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
- http://lwn.net/Alerts/194228/
- http://secunia.com/advisories/21253Vendor Advisory
- http://secunia.com/advisories/21274Vendor Advisory
- http://secunia.com/advisories/21290Vendor Advisory
- http://secunia.com/advisories/21304Vendor Advisory
- http://secunia.com/advisories/21319Vendor Advisory
- http://secunia.com/advisories/21334Vendor Advisory
- http://secunia.com/advisories/21338Vendor Advisory
- http://secunia.com/advisories/21346Vendor Advisory
- http://secunia.com/advisories/21370Vendor Advisory
- http://secunia.com/advisories/21392Vendor Advisory
- http://secunia.com/advisories/21501Vendor Advisory
- http://secunia.com/advisories/21537Vendor Advisory
- http://secunia.com/advisories/21598Vendor Advisory
- http://secunia.com/advisories/21632Vendor Advisory
- http://secunia.com/advisories/22036Vendor Advisory
- http://secunia.com/advisories/27181Vendor Advisory
- http://secunia.com/advisories/27222Vendor Advisory
- http://secunia.com/advisories/27832Vendor Advisory
- http://securitytracker.com/id?1016628
- http://securitytracker.com/id?1016671
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1
- http://support.avaya.com/elmodocs2/security/ASA-2006-166.htm
- http://www.debian.org/security/2006/dsa-1137Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.