Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service :

CVE-2017-11613

Ddenial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack and can either make the system hand or trigger the OOM killer.

CVE-2018-5784

There is an uncontrolled resource consumption in TIFFSetDirectory function of src/libtiff/tif_dir.c, which can cause denial of service through a crafted tif file.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u21.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3606-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1334 advisory.

    This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 9.6. It addresses 86 CVEs:
    CVE-2008-2327, CVE-2010-2067, CVE-2024-7006, CVE-2022-1355, CVE-2018-19210, and 81 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
119314	Debian DSA-4349-1 : tiff - security update	Nessus	Debian Local Security Checks	12/1/2018	7/18/2024	high
142585	EulerOS Virtualization 3.0.6.6 : libtiff (EulerOS-SA-2020-2448)	Nessus	Huawei Local Security Checks	11/6/2020	2/9/2024	high
110313	Debian DLA-1391-1 : tiff security update	Nessus	Debian Local Security Checks	6/5/2018	9/26/2024	medium
108657	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3606-1)	Nessus	Ubuntu Local Security Checks	3/27/2018	8/27/2024	critical
355652	Rocky Linux 9.6 [CIQ] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ciqsa-2026_1334)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	high
140145	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2020-1924)	Nessus	Huawei Local Security Checks	9/2/2020	2/22/2024	high

Detections

Analytics

Plugins Search

high

high

medium

critical

high

high