libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3194 advisory.

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1212 advisory.

    A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

    A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at     tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service     via a crafted tiff file. (CVE-2023-3164)

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3019 advisory.

    Multiple potential integer overflow in tiffcp.c in libtiff <= 4.5.1 can allow remote attackers to cause a     denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which     triggers a heap-based buffer overflow. (CVE-2023-40745)

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303084	Amazon Linux 2 : compat-libtiff3, --advisory ALAS2-2026-3194 (ALAS-2026-3194)	Nessus	Amazon Linux Local Security Checks	medium
299837	Linux Distros Unpatched Vulnerability : CVE-2025-61145	Nessus	Misc.	medium
270529	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2025-1212)	Nessus	Amazon Linux Local Security Checks	medium
270516	Amazon Linux 2 : libtiff, --advisory ALAS2-2025-3019 (ALAS-2025-3019)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2025-61145

medium

Tenable Plugins

medium

medium

medium

medium