A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the     function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to     be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to     apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by     the maintainer.(CVE-2025-8177)

    A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this     vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The     manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity     of an attack is rather high. The exploitation appears to be difficult. The patch is named     2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this     issue.(CVE-2024-13978)

Tenable has extracted the preceding description block directly from the EulerOS libtiff security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984792 advisory.

    A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this     vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The     manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity     of an attack is rather high. The exploitation appears to be difficult. The patch is named     2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4315 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4315-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     September 30, 2025                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tiff     Version        : 4.2.0-1+deb11u7     CVE ID         : CVE-2024-13978 CVE-2025-9900     Debian Bug     :

    Multiple vulnerabilities were fixed in tiff, a library and tools     providing support for the Tag Image File Format (TIFF).

    CVE-2024-13978

        Affected by this vulnerability is the function t2p_read_tiff_init of         the file tools/tiff2pdf.c of the component fax2ps. The manipulation         leads to null pointer dereference. The attack needs to be approached         locally. The complexity of an attack is rather high. The exploitation         appears to be difficult.

    CVE-2025-9900

        This vulnerability is a write-what-where condition, triggered         when the library processes a specially crafted TIFF image file.
        By providing an abnormally large image height value in the file's         metadata, an attacker can trick the library into writing         attacker-controlled color data to an arbitrary memory location.
        This memory corruption can be exploited to cause a denial of         service (application crash) or to achieve arbitrary code execution         with the permissions of the user.

    For Debian 11 bullseye, these problems have been fixed in version     4.2.0-1+deb11u7.

    We recommend that you upgrade your tiff packages.

    For the detailed security status of tiff please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tiff

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03348-1 advisory.

    - CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
    - CVE-2024-13978: null pointer dereference in component fax2ps (bsc#1247581)
    - CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
    - CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5869edf3de advisory.

    - fix CVE-2025-8534: null pointer dereference in tiff2ps (rhbz#2386494)


    ----

    - fix CVE-2024-13978: null pointer dereference in tiff2pdf (rhbz#2386201)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c612cbc58f advisory.

    Automatic update for libtiff-4.7.0-8.fc44.

    ##### **Changelog**

    ```
    * Mon Aug 25 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.7.0-8
    - fix  CVE-2025-9165: memory leak in tiffcmp (rhbz#2389608)
    * Tue Aug 12 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.7.0-7
    - fix CVE-2024-13978: null pointer dereference in tiff2pdf (rhbz#2386201)
    - fix CVE-2025-8534: null pointer dereference in tiff2ps (rhbz#2386494)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ebff4d54bf advisory.

    Automatic update for libtiff-4.7.0-8.fc43.

    ##### **Changelog**

    ```
    * Mon Aug 25 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.7.0-8
    - fix  CVE-2025-9165: memory leak in tiffcmp (rhbz#2389608)
    * Tue Aug 12 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.7.0-7
    - fix CVE-2024-13978: null pointer dereference in tiff2pdf (rhbz#2386201)
    - fix CVE-2025-8534: null pointer dereference in tiff2ps (rhbz#2386494)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this     vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The     manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity     of an attack is rather high. The exploitation appears to be difficult. The patch is named     2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.
    (CVE-2024-13978)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a78662be2c advisory.

    - fixes CVE-2025-8534: null pointer dereference in tiff2p
    - fixes CVE-2024-13978: null pointer dereference in tiff2pdf


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
270039	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2025-2234)	Nessus	Huawei Local Security Checks	medium
270014	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2025-2202)	Nessus	Huawei Local Security Checks	medium
267378	Unity Linux 20.1070e Security Update: libtiff (UTSA-2025-984792)	Nessus	Unity Linux Local Security Checks	low
266296	Debian dla-4315 : libtiff-dev - security update	Nessus	Debian Local Security Checks	low
265834	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tiff (SUSE-SU-2025:03348-1)	Nessus	SuSE Local Security Checks	medium
258026	Fedora 41 : libtiff (2025-5869edf3de)	Nessus	Fedora Local Security Checks	low
254437	Fedora 44 : libtiff (2025-c612cbc58f)	Nessus	Fedora Local Security Checks	low
254436	Fedora 43 : libtiff (2025-ebff4d54bf)	Nessus	Fedora Local Security Checks	low
252700	Linux Distros Unpatched Vulnerability : CVE-2024-13978	Nessus	Misc.	low
249974	Fedora 42 : libtiff (2025-a78662be2c)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2024-13978

low

Tenable Plugins

medium

medium

low

low

medium

low

low

low

low

low