An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0106 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-40090:
    An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file.

    CVE-2023-3618:
    A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.

    CVE-2023-40745:
    LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow.

    CVE-2023-41175:
    A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow.

    CVE-2023-6228:
    An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2289 advisory.

    - Fix CVE-2023-6228
    - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2289 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)

    * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)

    * libtiff: integer overflow in tiffcp.c (CVE-2023-40745)

    * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
    (CVE-2023-3618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
    (CVE-2023-3618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4869-1 advisory.

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted     TIFF image. (CVE-2023-26965)

  - A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.
    This flaw allows a local attacker to craft specific input data that can cause the program to dereference a     NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
    (CVE-2023-2731)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4736-1 advisory.

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted     TIFF image. (CVE-2023-26965)

  - A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.
    This flaw allows a local attacker to craft specific input data that can cause the program to dereference a     NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
    (CVE-2023-2731)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6512-1 advisory.

    It was discovered that LibTIFF could be made to run into an infinite loop. If a user or an automated     system were tricked into opening a specially crafted image file, an attacker could possibly use this issue     to cause a denial of service. (CVE-2022-40090)

    It was discovered that LibTIFF could be made leak memory. If a user or an automated system were tricked     into opening a specially crafted image file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2023-3576)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-351 advisory.

    An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236104	Alibaba Cloud Linux 3 : 0106: libtiff (ALINUX3-SA-2024:0106)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
224983	Linux Distros Unpatched Vulnerability : CVE-2022-40090	Nessus	Misc.	medium
195071	Oracle Linux 9 : libtiff (ELSA-2024-2289)	Nessus	Oracle Linux Local Security Checks	medium
194805	RHEL 9 : libtiff (RHSA-2024:2289)	Nessus	Red Hat Local Security Checks	medium
189068	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2023-3184)	Nessus	Huawei Local Security Checks	medium
188998	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2023-3036)	Nessus	Huawei Local Security Checks	medium
188987	EulerOS Virtualization 2.10.0 : libtiff (EulerOS-SA-2023-3475)	Nessus	Huawei Local Security Checks	medium
188968	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2023-3013)	Nessus	Huawei Local Security Checks	medium
188810	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2023-3219)	Nessus	Huawei Local Security Checks	medium
188790	EulerOS Virtualization 2.10.1 : libtiff (EulerOS-SA-2023-3503)	Nessus	Huawei Local Security Checks	medium
188725	EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2023-3361)	Nessus	Huawei Local Security Checks	medium
188696	EulerOS Virtualization 2.11.0 : libtiff (EulerOS-SA-2023-3380)	Nessus	Huawei Local Security Checks	medium
188642	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2024-1012)	Nessus	Huawei Local Security Checks	medium
188575	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2023-3339)	Nessus	Huawei Local Security Checks	medium
188329	EulerOS Virtualization 2.9.1 : libtiff (EulerOS-SA-2024-1038)	Nessus	Huawei Local Security Checks	medium
188115	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2023-3307)	Nessus	Huawei Local Security Checks	medium
186935	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tiff (SUSE-SU-2023:4869-1)	Nessus	SuSE Local Security Checks	medium
186810	SUSE SLES12 Security Update : tiff (SUSE-SU-2023:4736-1)	Nessus	SuSE Local Security Checks	medium
186225	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-6512-1)	Nessus	Ubuntu Local Security Checks	medium
181700	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-351)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2022-40090

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium