The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1546 advisory.

    - Add patches for CVEs:
      CVE-2015-7554, CVE-2015-8683, CVE-2015-8665,       CVE-2015-8781, CVE-2015-8782, CVE-2015-8783,       CVE-2015-8784
    - Update patches for CVEs:
      CVE-2014-8127, CVE-2014-8130
    - Update patches:
      CVE-2014-9330, CVE-2014-8127, CVE-2014-8129       CVE-2014-8130
    - Update patch for CVE-2015-8668
    - Remove patches for CVEs:
      CVE-2014-8127, CVE-2014-8129, CVE-2014-8130,       CVE-2014-9330, CVE-2015-7554, CVE-2015-8665,       CVE-2015-8683, CVE-2015-8781, CVE-2015-8784
    - Add patches for CVEs:
      CVE-2016-3632, CVE-2016-3945, CVE-2016-3990,       CVE-2016-3991, CVE-2016-5320
    - Update patches for CVEs:
      CVE-2014-9655, CVE-2015-1547, CVE-2015-8668
    - CVE-2014-8127 should contain only two fixes
    - Revert previous patch CVE-2014-8127
    - Fix patch CVE-2014-8127. Wrongly applied
    - Fix patch CVE-2015-8668. Wrongly applied by me
    - CVE-2014-8127, CVE-2014-8129, CVE-2014-8130
    - CVE-2014-9330, CVE-2014-9655, CVE-2015-8781
    - CVE-2015-8784, CVE-2015-1547, CVE-2015-8683
    - CVE-2015-8665, CVE-2015-7554, CVE-2015-8668

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1547 advisory.

    - Update patch for CVE-2014-8127
    - Fix patches for CVE-2016-3990 and CVE-2016-5320
    - CVE-2016-3632 CVE-2016-3945 CVE-2016-3990
    - CVE-2016-3991 CVE-2016-5320
    - Update patch for CVE-2014-8129
    - CVE-2013-1960 CVE-2013-1961 CVE-2013-4231
    - CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
    - Patch typos in CVE-2014-8127
    - Fix CVE-2014-8127 and CVE-2015-8668 patches

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1547 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a     crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against     libtiff into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547, CVE-2015-8784,     CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2016-3990, CVE-2016-5320)

    * Multiple flaws have been discovered in various libtiff tools (bmp2tiff, pal2rgb, thumbnail, tiff2bw,     tiff2pdf, tiffcrop, tiffdither, tiffsplit, tiff2rgba). By tricking a user into processing a specially     crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and,     possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2014-8127,     CVE-2014-8129, CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632, CVE-2016-3945,     CVE-2016-3991)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-598:01 advisory.

    The libtiff package contains a library of functions for manipulating     TIFF (Tagged Image File Format) image format files.  TIFF is a widely     used file format for bitmapped images.  TIFF files usually end in the     .tif extension and they are often quite large.
    The libtiff package should be installed if you need to manipulate TIFF     format image files.
    Security issues fixed with this release:
    CVE-2014-8127
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-8129
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-8130
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-9330     Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows     remote attackers to cause a denial of service (crash) via crafted BMP     image, related to dimensions, which triggers an out-of-bounds read.
    CVE-2014-9655     The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2)     NeXTDecode function in tif_next.c in LibTIFF allows remote attackers     to cause a denial of service (uninitialized memory access) via a     crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and     libtiff-cvs-2.tif.
    CVE-2015-1547     The NeXTDecode function in tif_next.c in LibTIFF allows remote     attackers to cause a denial of service (uninitialized memory access)     via a crafted TIFF image, as demonstrated by libtiff5.tif.
    CVE-2015-7554     The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows     attackers to cause a denial of service (invalid memory write and     crash) or possibly have unspecified other impact via crafted field     data in an extension tag in a TIFF image.
    CVE-2015-8665     tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a     denial of service (out-of-bounds read) via the SamplesPerPixel tag in     a TIFF image.
    CVE-2015-8668     Heap-based buffer overflow in the PackBitsPreEncode function in     tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service via a     large width field in a BMP image.
    CVE-2015-8683     The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6     allows remote attackers to cause a denial of service (out-of-bounds     read) via a packed TIFF image.
    CVE-2015-8781     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds write) via an invalid number of samples per pixel in a     LogL compressed TIFF image, a different vulnerability than     CVE-2015-8782.
    CVE-2015-8782     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds writes) via a crafted TIFF image, a different     vulnerability than CVE-2015-8781.
    CVE-2015-8783     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds reads) via a crafted TIFF image.
    CVE-2015-8784     The NeXTDecode function in tif_next.c in LibTIFF allows remote     attackers to cause a denial of service (out-of-bounds write) via a     crafted TIFF image, as demonstrated by libtiff5.tif.
    CVE-2016-3632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3945
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3990
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3991
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-5320
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-585:01 advisory.

    The libtiff package contains a library of functions for manipulating     TIFF (Tagged Image File Format) image format files.  TIFF is a widely     used file format for bitmapped images.  TIFF files usually end in the     .tif extension and they are often quite large.
    The libtiff package should be installed if you need to manipulate TIFF     format image files.
    Security issues fixed with this release:
    CVE-2014-8127
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-8129
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-8130
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-9330     Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows     remote attackers to cause a denial of service (crash) via crafted BMP     image, related to dimensions, which triggers an out-of-bounds read.
    CVE-2014-9655     The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2)     NeXTDecode function in tif_next.c in LibTIFF allows remote attackers     to cause a denial of service (uninitialized memory access) via a     crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and     libtiff-cvs-2.tif.
    CVE-2015-1547     The NeXTDecode function in tif_next.c in LibTIFF allows remote     attackers to cause a denial of service (uninitialized memory access)     via a crafted TIFF image, as demonstrated by libtiff5.tif.
    CVE-2015-7554     The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows     attackers to cause a denial of service (invalid memory write and     crash) or possibly have unspecified other impact via crafted field     data in an extension tag in a TIFF image.
    CVE-2015-8665     tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a     denial of service (out-of-bounds read) via the SamplesPerPixel tag in     a TIFF image.
    CVE-2015-8668     Heap-based buffer overflow in the PackBitsPreEncode function in     tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service via a     large width field in a BMP image.
    CVE-2015-8683     The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6     allows remote attackers to cause a denial of service (out-of-bounds     read) via a packed TIFF image.
    CVE-2015-8781     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds write) via an invalid number of samples per pixel in a     LogL compressed TIFF image, a different vulnerability than     CVE-2015-8782.
    CVE-2015-8782     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds writes) via a crafted TIFF image, a different     vulnerability than CVE-2015-8781.
    CVE-2015-8783     tif_luv.c in libtiff allows attackers to cause a denial of service     (out-of-bounds reads) via a crafted TIFF image.
    CVE-2015-8784     The NeXTDecode function in tif_next.c in LibTIFF allows remote     attackers to cause a denial of service (out-of-bounds write) via a     crafted TIFF image, as demonstrated by libtiff5.tif.
    CVE-2016-3632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3945
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3990
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-3991
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-5320
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have     unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that     the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.
    (CVE-2014-8129)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
92689	Oracle Linux 7 : libtiff (ELSA-2016-1546)	Nessus	Oracle Linux Local Security Checks	8/3/2016	8/29/2025	critical
92690	Oracle Linux 6 : libtiff (ELSA-2016-1547)	Nessus	Oracle Linux Local Security Checks	8/3/2016	8/29/2025	critical
92697	RHEL 6 : libtiff (RHSA-2016:1547)	Nessus	Red Hat Local Security Checks	8/3/2016	8/29/2025	critical
289305	MiracleLinux 7 : libtiff-4.0.3-25.el7 (AXSA:2016-598:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
289603	MiracleLinux 4 : libtiff-3.9.4-18.AXS4 (AXSA:2016-585:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
218578	Linux Distros Unpatched Vulnerability : CVE-2014-8129	Nessus	Misc.	3/4/2025	7/20/2026	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high