A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtiff: Heap-based buffer overflow in TIFF2PDF tool (CVE-2020-35524)

  - libtiff: heap-buffer overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c     (CVE-2023-25434)

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-2.el9 build changelog.

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-050 advisory.

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit f2b656e2. (CVE-2022-0907)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.
    (CVE-2022-1056)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1623)

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

  - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the     extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this     flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw     could cause a crash or potentially further exploitation. (CVE-2022-2869)

  - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability     allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the tiffsplit or     tiffcrop utilities. (CVE-2022-34526)

  - A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function     TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is     possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
    The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to     fix this issue. The identifier VDB-213549 was assigned to this vulnerability. (CVE-2022-3970)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5333 advisory.

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1623)

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

  - There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1     (CVE-2022-2519)

  - A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at     tiffcrop.c:8621 that can cause program crash when reading a crafted input. (CVE-2022-2520)

  - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at     tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while     processing crafted input. (CVE-2022-2521)

  - libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An     attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with     certain parameters) could cause a crash or in some cases, further exploitation. (CVE-2022-2867)

  - libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and     ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. (CVE-2022-2868)

  - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the     extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this     flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw     could cause a crash or potentially further exploitation. (CVE-2022-2869)

  - LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing     attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from     sources, the fix is available with commit 48d6ece8. (CVE-2022-2953)

  - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability     allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the tiffsplit or     tiffcrop utilities. (CVE-2022-34526)

  - Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to     trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into     application crash, potential information disclosure or any other context-dependent impact (CVE-2022-3570)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3597)

  - LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit e8131125. (CVE-2022-3599)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3627)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. This affects the function
    __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler.
    The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The     associated identifier of this vulnerability is VDB-211935. (CVE-2022-3636)

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3278 advisory.

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

  - libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An     attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with     certain parameters) could cause a crash or in some cases, further exploitation. (CVE-2022-2867)

  - libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and     ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. (CVE-2022-2868)

  - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the     extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this     flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw     could cause a crash or potentially further exploitation. (CVE-2022-2869)

  - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability     allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the tiffsplit or     tiffcrop utilities. (CVE-2022-34526)

  - Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to     trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into     application crash, potential information disclosure or any other context-dependent impact (CVE-2022-3570)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3597)

  - LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604,     allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff     from sources, the fix is available with commit cfbb883b. (CVE-2022-3598)

  - LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit e8131125. (CVE-2022-3599)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from     processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3626)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3627)

  - A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function     TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is     possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
    The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to     fix this issue. The identifier VDB-213549 was assigned to this vulnerability. (CVE-2022-3970)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8194 advisory.

    [4.4.0-2]
    - Update to version 4.4.0
    - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865       CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1354       CVE-2022-1355

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8194 advisory.

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8194 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561)

    * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562)

    * libtiff: reachable assertion (CVE-2022-0865)

    * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924)

    * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355)

    * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844)

    * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891)

    * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c     (CVE-2022-0908)

    * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909)

    * libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-183 advisory.

  - Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.
    (CVE-2022-1056)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1623)

  - libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the     extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this     flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw     could cause a crash or potentially further exploitation. (CVE-2022-2869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-194 advisory.

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

  - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability     allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file. (CVE-2022-34526)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-10 (LibTIFF: Multiple Vulnerabilities)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit f2b656e2. (CVE-2022-0907)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.
    (CVE-2022-1056)

  - A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is     the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be     launched remotely but requires user interaction. The exploit has been disclosed to the public and may be     used. (CVE-2022-1210)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1623)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5619-1 advisory.

    It was discovered that LibTIFF was not properly performing the calculation of data that would eventually     be used as a reference for bound-checking operations. An attacker could possibly use this issue to cause a     denial of service or to expose sensitive information. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2020-19131)

    It was discovered that LibTIFF was not properly terminating a function execution when processing incorrect     data. An attacker could possibly use this issue to cause a denial of service or to expose sensitive     information. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-19144)

    It was discovered that LibTIFF did not properly manage memory under certain circumstances. If a user were     tricked into opening a specially crafted TIFF file using tiffinfo tool, an attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-1354)

    It was discovered that LibTIFF did not properly manage memory under certain circumstances. If a user were     tricked into opening a specially crafted TIFF file using tiffcp tool, an attacker could possibly use this     issue to

    cause a denial of service. (CVE-2022-1355)

    It was discovered that LibTIFF was not properly performing checks to avoid division calculations where the     denominator value was zero, which could lead to an undefined behaviour situation via a specially crafted     file. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2056,     CVE-2022-2057, CVE-2022-2058)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-094 advisory.

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198563	RHEL 8 : libtiff (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196567	RHEL 8 : libtiff (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191155	CentOS 9 : libtiff-4.4.0-2.el9	Nessus	CentOS Local Security Checks	high
173149	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-050)	Nessus	Amazon Linux Local Security Checks	high
170770	Debian DSA-5333-1 : tiff - security update	Nessus	Debian Local Security Checks	high
170240	Debian DLA-3278-1 : tiff - LTS security update	Nessus	Debian Local Security Checks	high
169339	EulerOS Virtualization 2.10.1 : libtiff (EulerOS-SA-2022-2885)	Nessus	Huawei Local Security Checks	medium
169311	EulerOS Virtualization 2.10.0 : libtiff (EulerOS-SA-2022-2867)	Nessus	Huawei Local Security Checks	medium
168086	Oracle Linux 9 : libtiff (ELSA-2022-8194)	Nessus	Oracle Linux Local Security Checks	high
167988	AlmaLinux 9 : libtiff (ALSA-2022:8194)	Nessus	Alma Linux Local Security Checks	high
167604	RHEL 9 : libtiff (RHSA-2022:8194)	Nessus	Red Hat Local Security Checks	high
167012	Amazon Linux 2022 : (ALAS2022-2022-183)	Nessus	Amazon Linux Local Security Checks	medium
167001	Amazon Linux 2022 : (ALAS2022-2022-194)	Nessus	Amazon Linux Local Security Checks	high
166716	GLSA-202210-10 : LibTIFF: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
165371	EulerOS Virtualization 2.9.1 : libtiff (EulerOS-SA-2022-2352)	Nessus	Huawei Local Security Checks	medium
165350	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2022-2388)	Nessus	Huawei Local Security Checks	medium
165277	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-5619-1)	Nessus	Ubuntu Local Security Checks	medium
165041	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2022-2297)	Nessus	Huawei Local Security Checks	medium
165037	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2022-2326)	Nessus	Huawei Local Security Checks	medium
164783	Amazon Linux 2022 : (ALAS2022-2022-094)	Nessus	Amazon Linux Local Security Checks	medium
164183	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2022-2259)	Nessus	Huawei Local Security Checks	medium
164178	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2022-2246)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2022-1354

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium

high

high

high

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium