CVE-2006-3459 - 漏洞详情

CVE-2006-3459 (CNNVD-200608-037)

HIGH 有利用代码

中文标题:

Libtiff图形库多个栈缓冲区溢出漏洞

英文标题:

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe R...

CVSS分数: 7.5

发布时间: 2006-08-03 01:00:00

漏洞类型: 授权问题

状态: PUBLISHED

数据质量分数: 0.40

数据版本: v9

漏洞描述

中文描述:

Silicon Graphics LibTIFF是美国Silicon Graphics公司的一个读写TIFF（标签图像文件格式）文件的库。该库包含一些处理TIFF文件的命令行工具。在Adobe Reader 9.3.0和其他产品中使用的TIFF库（libtiff） 3.8.2之前版本中存在多个基于栈的缓冲区溢出漏洞。远程攻击者可借助未明向量执行任意代码或导致拒绝服务。

英文描述:

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.

CWE类型:

CWE-119

受影响产品

厂商	产品	版本	版本范围	平台	CPE
libtiff	libtiff	*	-	-	`cpe:2.3:a:libtiff:libtiff::::::::`
libtiff	libtiff	3.4	-	-	`cpe:2.3:a:libtiff:libtiff:3.4:::::::*`
libtiff	libtiff	3.5.1	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.1:::::::*`
libtiff	libtiff	3.5.2	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.2:::::::*`
libtiff	libtiff	3.5.3	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.3:::::::*`
libtiff	libtiff	3.5.4	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.4:::::::*`
libtiff	libtiff	3.5.5	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.5:::::::*`
libtiff	libtiff	3.5.6	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.6:::::::*`
libtiff	libtiff	3.5.7	-	-	`cpe:2.3:a:libtiff:libtiff:3.5.7:::::::*`
libtiff	libtiff	3.6.0	-	-	`cpe:2.3:a:libtiff:libtiff:3.6.0:::::::*`
libtiff	libtiff	3.6.1	-	-	`cpe:2.3:a:libtiff:libtiff:3.6.1:::::::*`
libtiff	libtiff	3.7.0	-	-	`cpe:2.3:a:libtiff:libtiff:3.7.0:::::::*`
libtiff	libtiff	3.7.1	-	-	`cpe:2.3:a:libtiff:libtiff:3.7.1:::::::*`
libtiff	libtiff	3.7.2	-	-	`cpe:2.3:a:libtiff:libtiff:3.7.2:::::::*`
libtiff	libtiff	3.7.3	-	-	`cpe:2.3:a:libtiff:libtiff:3.7.3:::::::*`
libtiff	libtiff	3.7.4	-	-	`cpe:2.3:a:libtiff:libtiff:3.7.4:::::::*`
libtiff	libtiff	3.8.0	-	-	`cpe:2.3:a:libtiff:libtiff:3.8.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

20060801-01-P vendor-advisory
cve.org

访问

APPLE-SA-2006-08-01 vendor-advisory
cve.org

访问

ADV-2007-3486 vdb-entry
cve.org

访问

21501 third-party-advisory
cve.org

访问

MDKSA-2006:136 vendor-advisory
cve.org

访问

21537 third-party-advisory
cve.org

访问

21632 third-party-advisory
cve.org

访问

GLSA-200608-07 vendor-advisory
cve.org

访问

21338 third-party-advisory
cve.org

访问

USN-330-1 vendor-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

ADV-2006-3101 vdb-entry
cve.org

访问

1016628 vdb-entry
cve.org

访问

21253 third-party-advisory
cve.org

访问

DSA-1137 vendor-advisory
cve.org

访问

21370 third-party-advisory
cve.org

访问

1016671 vdb-entry
cve.org

访问

21598 third-party-advisory
cve.org

访问

RHSA-2006:0648 vendor-advisory
cve.org

访问

MDKSA-2006:137 vendor-advisory
cve.org

访问

19289 vdb-entry
cve.org

访问

27222 third-party-advisory
cve.org

访问

ADV-2007-4034 vdb-entry
cve.org

访问

TA06-214A third-party-advisory
cve.org

访问

SUSE-SA:2006:044 vendor-advisory
cve.org

访问

21290 third-party-advisory
cve.org

访问

oval:org.mitre.oval:def:11497 vdb-entry
cve.org

访问

21274 third-party-advisory
cve.org

访问

ADV-2006-3105 vdb-entry
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

27181 third-party-advisory
cve.org

访问

RHSA-2006:0603 vendor-advisory
cve.org

访问

20060901-01-P vendor-advisory
cve.org

访问

21304 third-party-advisory
cve.org

访问

19283 vdb-entry
cve.org

访问

SSA:2006-230-01 vendor-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

27832 third-party-advisory
cve.org

访问

21346 third-party-advisory
cve.org

访问

201331 vendor-advisory
cve.org

访问

21319 third-party-advisory
cve.org

访问

21392 third-party-advisory
cve.org

访问

21334 third-party-advisory
cve.org

访问

22036 third-party-advisory
cve.org

访问

27723 vdb-entry
cve.org

访问

2006-0044 vendor-advisory
cve.org

访问

103160 vendor-advisory
cve.org

访问

ExploitDB EDB-11787 EXPLOIT
exploitdb

访问

Download Exploit EDB-11787 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2010-0188 ADVISORY
cve.org

访问

CVE Reference: CVE-2006-3459 ADVISORY
cve.org

访问

ExploitDB EDB-16862 EXPLOIT
exploitdb

访问

Download Exploit EDB-16862 EXPLOIT
exploitdb

访问

ExploitDB EDB-16868 EXPLOIT
exploitdb

访问

Download Exploit EDB-16868 EXPLOIT
exploitdb

访问

ExploitDB EDB-16869 EXPLOIT
exploitdb

访问

Download Exploit EDB-16869 EXPLOIT
exploitdb

访问

ExploitDB EDB-21868 EXPLOIT
exploitdb

访问

Download Exploit EDB-21868 EXPLOIT
exploitdb

访问

ExploitDB EDB-21869 EXPLOIT
exploitdb

访问

Download Exploit EDB-21869 EXPLOIT
exploitdb

访问

CVSS评分详情

7.5

HIGH

CVSS向量: AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS版本: 2.0

机密性

PARTIAL

完整性

PARTIAL

可用性

PARTIAL

时间信息

发布时间:

2006-08-03 01:00:00

修改时间:

2024-08-07 18:30:33

创建时间:

2025-11-11 15:32:35

更新时间:

2026-01-19 09:41:51

利用信息

此漏洞有可利用代码！

利用代码数量: 6

利用来源:

未知未知未知未知未知未知

数据源详情

数据源	记录ID	版本	提取时间
CVE	`cve_CVE-2006-3459`	2025-11-11 15:17:43	2025-11-11 07:32:35
NVD	`nvd_CVE-2006-3459`	2025-11-11 14:51:50	2025-11-11 07:41:20
CNNVD	`cnnvd_CNNVD-200608-037`	2025-11-11 15:08:46	2025-11-11 07:49:09
EXPLOITDB	`exploitdb_EDB-11787`	2025-11-11 15:05:52	2025-11-11 08:03:28
EXPLOITDB	`exploitdb_EDB-16862`	2025-11-11 15:05:22	2025-11-11 08:11:15
EXPLOITDB	`exploitdb_EDB-16868`	2025-11-11 15:05:22	2025-11-11 08:11:15
EXPLOITDB	`exploitdb_EDB-16869`	2025-11-11 15:05:22	2025-11-11 08:11:15
EXPLOITDB	`exploitdb_EDB-21868`	2025-11-11 15:05:23	2025-11-11 08:16:35
EXPLOITDB	`exploitdb_EDB-21869`	2025-11-11 15:05:23	2025-11-11 08:16:35

版本与语言

当前版本: v9

主要语言: EN

支持语言:

EN ZH

其他标识符:

安全公告

暂无安全公告信息

变更历史

v9 EXPLOITDB

2025-11-11 16:16:35

references_count: 59 → 61

查看详细变更

references_count: 59 -> 61

v8 EXPLOITDB

2025-11-11 16:16:35

references_count: 57 → 59; tags_count: 8 → 9

查看详细变更

references_count: 57 -> 59
tags_count: 8 -> 9

v7 EXPLOITDB

2025-11-11 16:11:15

references_count: 55 → 57

查看详细变更

references_count: 55 -> 57

v6 EXPLOITDB

2025-11-11 16:11:15

references_count: 53 → 55

查看详细变更

references_count: 53 -> 55

v5 EXPLOITDB

2025-11-11 16:11:15

references_count: 51 → 53; tags_count: 5 → 8

查看详细变更

references_count: 51 -> 53
tags_count: 5 -> 8

v4 EXPLOITDB

2025-11-11 16:03:28

references_count: 47 → 51; tags_count: 0 → 5; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']

查看详细变更

references_count: 47 -> 51
tags_count: 0 -> 5
data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']

v3 CNNVD

2025-11-11 15:49:09

vulnerability_type: 未提取 → 授权问题; cnnvd_id: 未提取 → CNNVD-200608-037; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']

查看详细变更

vulnerability_type: 未提取 -> 授权问题
cnnvd_id: 未提取 -> CNNVD-200608-037
data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']

v2 NVD

2025-11-11 15:41:20

severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.5; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:P/I:P/A:P; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 17; data_sources: ['cve'] → ['cve', 'nvd']

查看详细变更

severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
cvss_score: 未提取 -> 7.5
cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:P/I:P/A:P
cvss_version: NOT_EXTRACTED -> 2.0
affected_products_count: 0 -> 17
data_sources: ['cve'] -> ['cve', 'nvd']

CVE-2006-3459 (CNNVD-200608-037)

中文标题:

Libtiff图形库多个栈缓冲区溢出漏洞

英文标题:

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe R...

漏洞描述

中文描述:

英文描述:

CWE类型:

标签:

受影响产品

解决方案

中文解决方案:

英文解决方案:

临时解决方案:

参考链接

CVSS评分详情

时间信息

利用信息

数据源详情

版本与语言

安全公告

变更历史