Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'invertImage()'     function in the component 'tiffcrop'. (CVE-2020-19131)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'invertImage()'     function in the component 'tiffcrop'. (CVE-2020-19131)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5619-1 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy'     funtion in the component 'tif_unix.c'. (CVE-2020-19144)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5523-1 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy'     funtion in the component 'tif_unix.c'. (CVE-2020-19144)

  - Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit f2b656e2. (CVE-2022-0907)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1810 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1810 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1810 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1810 advisory.

  - libtiff: a buffer overflow via the invertImage() may lead to DoS (CVE-2020-19131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1810 advisory.

  - libtiff: a buffer overflow via the invertImage() may lead to DoS (CVE-2020-19131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'invertImage()'     function in the component 'tiffcrop'. (CVE-2020-19131)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'invertImage()'     function in the component 'tiffcrop'. (CVE-2020-19131)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'invertImage()'     function in the component 'tiffcrop'. (CVE-2020-19131)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0480-1 advisory.

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can     lead to an abort, resulting in denial of service. (CVE-2020-35521)

  - In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an     abort, resulting in a remote denial of service attack. (CVE-2020-35522)

  - An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

  - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's     TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0496-1 advisory.

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can     lead to an abort, resulting in denial of service. (CVE-2020-35521)

  - In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an     abort, resulting in a remote denial of service attack. (CVE-2020-35522)

  - An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

  - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's     TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0480-1 advisory.

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can     lead to an abort, resulting in denial of service. (CVE-2020-35521)

  - In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an     abort, resulting in a remote denial of service attack. (CVE-2020-35522)

  - An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

  - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's     TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2777 advisory.

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy'     funtion in the component 'tif_unix.c'. (CVE-2020-19144)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
169681	EulerOS Virtualization 3.0.2.6 : libtiff (EulerOS-SA-2023-1079)	Nessus	Huawei Local Security Checks	high
165906	EulerOS Virtualization 3.0.6.6 : libtiff (EulerOS-SA-2022-2514)	Nessus	Huawei Local Security Checks	high
165277	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-5619-1)	Nessus	Ubuntu Local Security Checks	medium
163272	Ubuntu 16.04 ESM : LibTIFF vulnerabilities (USN-5523-1)	Nessus	Ubuntu Local Security Checks	high
161340	Rocky Linux 8 : libtiff (RLSA-2022:1810)	Nessus	Rocky Linux Local Security Checks	high
161306	Oracle Linux 8 : libtiff (ELSA-2022-1810)	Nessus	Oracle Linux Local Security Checks	high
161139	AlmaLinux 8 : libtiff (ALSA-2022:1810)	Nessus	Alma Linux Local Security Checks	high
161005	RHEL 8 : libtiff (RHSA-2022:1810)	Nessus	Red Hat Local Security Checks	high
160951	CentOS 8 : libtiff (CESA-2022:1810)	Nessus	CentOS Local Security Checks	high
160694	EulerOS Virtualization 3.0.2.0 : libtiff (EulerOS-SA-2022-1673)	Nessus	Huawei Local Security Checks	high
158485	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2022-1274)	Nessus	Huawei Local Security Checks	high
158476	EulerOS 2.0 SP5 : compat-libtiff3 (EulerOS-SA-2022-1264)	Nessus	Huawei Local Security Checks	high
158320	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2022-1175)	Nessus	Huawei Local Security Checks	high
158282	EulerOS 2.0 SP3 : compat-libtiff3 (EulerOS-SA-2022-1159)	Nessus	Huawei Local Security Checks	high
158234	openSUSE 15 Security Update : tiff (openSUSE-SU-2022:0480-1)	Nessus	SuSE Local Security Checks	high
158189	SUSE SLES12 Security Update : tiff (SUSE-SU-2022:0496-1)	Nessus	SuSE Local Security Checks	high
158138	SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2022:0480-1)	Nessus	SuSE Local Security Checks	high
153844	Debian DLA-2777-1 : tiff - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-19131

high

Tenable Plugins

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high