In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a     DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign     extended to an integer that produces more digits than expected in an sprintf call. (CVE-2006-2193)

  - Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-     dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG     stream that is longer than the scan line size (TiffScanLineSize). (CVE-2006-3460)

  - Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors. (CVE-2006-3461)

  - Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE     images. (CVE-2006-3462)

  - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short     when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial     of service via a large td_nstrips value, which triggers an infinite loop. (CVE-2006-3463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117)

  - LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows     remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
    (CVE-2014-8128)

  - Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7,     3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2,     4.0.3, 4.0.4, 4.0.4beta, 4.0.5 and 4.0.6 allows remote attackers to have unspecified impact via a crafted     image. (CVE-2016-10092)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117)

  - LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows     remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
    (CVE-2014-8128)

  - Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of     service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via     crafted width and length values in RLE4 or RLE8 data in a BMP file. (CVE-2015-8870)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117)

  - LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a     crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2)     compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in     tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5)     tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7)     TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. (CVE-2014-8127)

  - LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows     remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
    (CVE-2014-8128)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The TIFFFetchNormalTag function in LibTiff 4.0.6 allows     remote attackers to cause a denial of service     (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII     or TIFF_SETGET_C32_ASCII tag values.(CVE-2016-9297)

  - There is a heap based buffer overflow in     tools/tiff2pdf.c of LibTIFF 4.0.8 via a     PlanarConfig=Contig image, which causes a more than one     hundred bytes out-of-bounds write (related to the     ZIPDecode function in tif_zip.c). A crafted input may     lead to a remote denial of service attack or an     arbitrary code execution attack.(CVE-2017-11335)

  - In LibTIFF 4.0.7, a memory leak vulnerability was found     in the function OJPEGReadHeaderInfoSecTablesQTable in     tif_ojpeg.c, which allows attackers to cause a denial     of service via a crafted file.(CVE-2017-9404)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - A NULL Pointer Dereference occurs in the function     TIFFPrintDirectory in tif_print.c in LibTIFF 4.0.9 when     using the tiffinfo tool to print crafted TIFF     information, a different vulnerability than     CVE-2017-18013. (This affects an earlier part of the     TIFFPrintDirectory function that was not addressed by     the CVE-2017-18013 patch.)(CVE-2018-7456)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ChopUpSingleUncompressedStrip in tif_dirread.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted TIFF file, as demonstrated by     tiff2pdf.(CVE-2018-15209)

  - newoffsets handling in ChopUpSingleUncompressedStrip in     tif_dirread.c in LibTIFF 4.0.9 allows remote attackers     to cause a denial of service (heap-based buffer     overflow and application crash) or possibly have     unspecified other impact via a crafted TIFF file, as     demonstrated by tiff2pdf. This is a different     vulnerability than CVE-2018-15209.(CVE-2018-16335)

  - In LibTIFF 4.0.9, there is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a     crafted tif file. This occurs because the declared     number of directory entries is not validated against     the actual number of directory entries.(CVE-2018-5784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libtiff package has been released.

Added fix for **CVE-2018-5784**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.

Several issues were discovered in TIFF, the Tag Image File Format library, that allowed remote attackers to cause a denial of service or other unspecified impact via a crafted image file.

CVE-2017-11613: DoS vulnerability A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the
_TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer.

CVE-2018-10963: DoS vulnerability The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726.

CVE-2018-5784: DoS vulnerability In LibTIFF, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c.
Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

CVE-2018-7456: NULL pointer Dereference A NULL pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)

CVE-2018-8905: Heap-based buffer overflow In LibTIFF, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.

For Debian 8 'Jessie', these problems have been fixed in version 4.0.3-12.3+deb8u6.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service :

CVE-2017-11613

Ddenial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack and can either make the system hand or trigger the OOM killer.

CVE-2018-5784

There is an uncontrolled resource consumption in TIFFSetDirectory function of src/libtiff/tif_dir.c, which can cause denial of service through a crafted tif file.

For Debian 7 'Wheezy', these problems have been fixed in version 4.0.2-6+deb7u21.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

  - CVE-2017-9935: There was a heap-based buffer overflow in     the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution (bsc#1046077)

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2018-5784: There is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a crafted     tif file. This occurs because the declared number of     directory entries is not validated against the actual     number of directory entries (bsc#1081690)

This update was imported from the SUSE:SLE-12:Update update project.

This update for tiff fixes the following issues :

  - CVE-2017-9935: There was a heap-based buffer overflow in     the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution (bsc#1046077)

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2018-5784: There is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a crafted     tif file. This occurs because the declared number of     directory entries is not validated against the actual     number of directory entries (bsc#1081690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3606-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3602-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206852	NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)	Nessus	NewStart CGSL Local Security Checks	high
198513	RHEL 6 : libtiff (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198475	RHEL 7 : libtiff (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198470	RHEL 5 : libtiff (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196612	RHEL 5 : libtiff (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196585	RHEL 6 : libtiff (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196532	RHEL 7 : libtiff (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
151389	EulerOS Virtualization 3.0.2.2 : libtiff (EulerOS-SA-2021-2145)	Nessus	Huawei Local Security Checks	high
142585	EulerOS Virtualization 3.0.6.6 : libtiff (EulerOS-SA-2020-2448)	Nessus	Huawei Local Security Checks	high
142358	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2020-2361)	Nessus	Huawei Local Security Checks	high
140912	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2020-2145)	Nessus	Huawei Local Security Checks	high
140333	EulerOS Virtualization for ARM 64 3.0.2.0 : libtiff (EulerOS-SA-2020-1963)	Nessus	Huawei Local Security Checks	high
140145	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2020-1924)	Nessus	Huawei Local Security Checks	high
121936	Photon OS 2.0: Libtiff PHSA-2018-2.0-0039	Nessus	PhotonOS Local Security Checks	medium
120550	Fedora 28 : libtiff (2018-7a0f7f5768)	Nessus	Fedora Local Security Checks	medium
119314	Debian DSA-4349-1 : tiff - security update	Nessus	Debian Local Security Checks	high
110840	Debian DLA-1411-1 : tiff security update	Nessus	Debian Local Security Checks	high
110313	Debian DLA-1391-1 : tiff security update	Nessus	Debian Local Security Checks	medium
109716	openSUSE Security Update : tiff (openSUSE-2018-443)	Nessus	SuSE Local Security Checks	high
109675	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:1180-1)	Nessus	SuSE Local Security Checks	high
108702	Fedora 27 : libtiff (2018-e6a51e99a4)	Nessus	Fedora Local Security Checks	medium
108657	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3606-1)	Nessus	Ubuntu Local Security Checks	critical
108513	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3602-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-5784

medium

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

medium

medium

high

high

medium

high

high

medium

critical

high