A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7783-1 advisory.

    Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF     images. An attacker could possibly use this issue to cause LibTIFF to crash, resulting in a denial of     service. (CVE-2025-8961)

    Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF     image headers. An attacker could possibly use this issue to cause LibTIFF to leak memory, resulting in a     denial of service. (CVE-2025-9165)

    It was discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF image metadata. An     attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or     execute arbitrary code. (CVE-2025-9900)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4315 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4315-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     September 30, 2025                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tiff     Version        : 4.2.0-1+deb11u7     CVE ID         : CVE-2024-13978 CVE-2025-9900     Debian Bug     :

    Multiple vulnerabilities were fixed in tiff, a library and tools     providing support for the Tag Image File Format (TIFF).

    CVE-2024-13978

        Affected by this vulnerability is the function t2p_read_tiff_init of         the file tools/tiff2pdf.c of the component fax2ps. The manipulation         leads to null pointer dereference. The attack needs to be approached         locally. The complexity of an attack is rather high. The exploitation         appears to be difficult.

    CVE-2025-9900

        This vulnerability is a write-what-where condition, triggered         when the library processes a specially crafted TIFF image file.
        By providing an abnormally large image height value in the file's         metadata, an attacker can trick the library into writing         attacker-controlled color data to an arbitrary memory location.
        This memory corruption can be exploited to cause a denial of         service (application crash) or to achieve arbitrary code execution         with the permissions of the user.

    For Debian 11 bullseye, these problems have been fixed in version     4.2.0-1+deb11u7.

    We recommend that you upgrade your tiff packages.

    For the detailed security status of tiff please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tiff

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Libtiff. This vulnerability is a write-what-where condition, triggered when the     library processes a specially crafted TIFF image file. By providing an abnormally large image height value     in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to     an arbitrary memory location. This memory corruption can be exploited to cause a denial of service     (application crash) or to achieve arbitrary code execution with the permissions of the user.
    (CVE-2025-9900)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
266308	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : LibTIFF vulnerabilities (USN-7783-1)	Nessus	Ubuntu Local Security Checks	medium
266296	Debian dla-4315 : libtiff-dev - security update	Nessus	Debian Local Security Checks	low
265888	Linux Distros Unpatched Vulnerability : CVE-2025-9900	Nessus	Misc.	high

Detections

Analytics

CVE-2025-9900

high

Tenable Plugins

medium

low

high