Detections
Analytics
EulerOS Virtualization 2.13.0 : libtiff (EulerOS-SA-2025-2611)
low Nessus Plugin ID 281570
Synopsis
The remote EulerOS Virtualization host is missing multiple security updates.Description
According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :A flaw has been found in LibTIFF 4.7.0. This affects the function
_TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because 'this is a memory leak on a command line tool that is about to exit anyway'. In the reply the project maintainer declares this issue as 'a simple 'bug' when leaving the command line tool and (...) not a security issue at all'.(CVE-2025-9165)
A flaw was found in Libtiff. This vulnerability is a 'write-what-where' condition, triggered when the library processes a specially crafted TIFF image file.
By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.(CVE-2025-9900)
Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtiff security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected libtiff packages.See Also
Plugin Details
Severity: Low
ID: 281570
File Name: EulerOS_SA-2025-2611.nasl
Version: 1.1
Type: local
Family: Huawei Local Security Checks
Published: 12/31/2025
Updated: 12/31/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Low
Base Score: 1
Temporal Score: 0.8
Vector: CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:P
CVSS Score Source: CVE-2025-9165
CVSS v3
Risk Factor: Low
Base Score: 2.5
Temporal Score: 2.3
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2
Threat Score: 1.1
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:huawei:euleros:uvp:2.13.0, p-cpe:/a:huawei:euleros:libtiff
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/31/2025
Vulnerability Publication Date: 8/19/2025
Reference Information
CVE: CVE-2025-9165, CVE-2025-9900