An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users,     during install/upgrade workflow, to replace one of the Agent's executables before it can be executed. This     allows the user to elevate their permissions. (CVE-2023-0975)

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow. (CVE-2023-40745)

  - A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow. (CVE-2023-41175)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service. (CVE-2023-52356)

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the libtiff package has been released.

ID	Name	Product	Family	Severity
242726	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0128)	Nessus	NewStart CGSL Local Security Checks	high
237995	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0070)	Nessus	NewStart CGSL Local Security Checks	high
227328	Linux Distros Unpatched Vulnerability : CVE-2023-52355	Nessus	Misc.	high
204333	Photon OS 4.0: Libtiff PHSA-2024-4.0-0558	Nessus	PhotonOS Local Security Checks	high
204151	Photon OS 5.0: Libtiff PHSA-2024-5.0-0196	Nessus	PhotonOS Local Security Checks	high
203881	Photon OS 3.0: Libtiff PHSA-2024-3.0-0719	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2023-52355

high

Tenable Plugins

high

high

high

high

high

high