CVE-2016-5322: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Libtiff Libtiff: up to and including 4.0.6

Published 2017-04-11. Last modified 2026-06-17.