libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772642268 advisory.

  - libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer     function. (CVE-2025-61144)

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

  - A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of     the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be     executed locally. The exploit has been made available to the public and could be exploited.
    (CVE-2025-8961)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772642268 advisory.

  - libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer     function. (CVE-2025-61144)

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

  - A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of     the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be     executed locally. The exploit has been made available to the public and could be exploited.
    (CVE-2025-8961)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773829377 advisory.

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libtiff package has been released.

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3194 advisory.

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1212 advisory.

    A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

    A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at     tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service     via a crafted tiff file. (CVE-2023-3164)

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3019 advisory.

    Multiple potential integer overflow in tiffcp.c in libtiff <= 4.5.1 can allow remote attackers to cause a     denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which     triggers a heap-based buffer overflow. (CVE-2023-40745)

    libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
    (CVE-2025-61145)

    A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file     tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be     approached locally. The exploit has been disclosed to the public and may be used. (CVE-2025-8961)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
463684	Echo: tiff: security update to 4.7.0-3+e11	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463684	Echo: tiff: security update to 4.7.0-3+e11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
361349	Rocky Linux 9.6 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772642268)	Nessus	Rocky Linux Local Security Checks	Local	medium
361299	AlmaLinux 9.6 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772642268)	Nessus	Alma Linux Local Security Checks	Local	medium
353056	AlmaLinux 9.2 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools (ALMALINUX9.2:CLSA-2026:1773829377)	Nessus	Alma Linux Local Security Checks	Local	medium
332663	Photon OS 5.0: Libtiff PHSA-2026-5.0-92-0815	Nessus	PhotonOS Local Security Checks	Local	medium
332533	Photon OS 5.0: Libtiff PHSA-2026-5.0-91-0815	Nessus	PhotonOS Local Security Checks	Local	medium
306355	Photon OS 4.0: Libtiff PHSA-2026-4.0-0995	Nessus	PhotonOS Local Security Checks	Local	medium
306348	Photon OS 5.0: Libtiff PHSA-2026-5.0-0815	Nessus	PhotonOS Local Security Checks	Local	medium
303084	Amazon Linux 2 : compat-libtiff3, --advisory ALAS2-2026-3194 (ALAS-2026-3194)	Nessus	Amazon Linux Local Security Checks	Local	medium
299837	Linux Distros Unpatched Vulnerability : CVE-2025-61145	Nessus	Misc.	Local	medium
270529	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2025-1212)	Nessus	Amazon Linux Local Security Checks	Local	medium
270516	Amazon Linux 2 : libtiff, --advisory ALAS2-2025-3019 (ALAS-2025-3019)	Nessus	Amazon Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-61145

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium