An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtiff: Heap-based buffer overflow in TIFF2PDF tool (CVE-2020-35524)

  - libtiff: heap-buffer overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c     (CVE-2023-25434)

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2289 advisory.

  - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash. (CVE-2023-6228)

  - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow. (CVE-2023-40745)

  - A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow. (CVE-2023-41175)

  - A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
    (CVE-2023-3618)

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2289 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)

    * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)

    * libtiff: integer overflow in tiffcp.c (CVE-2023-40745)

    * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
    (CVE-2023-3618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
    (CVE-2023-3618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4869-1 advisory.

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted     TIFF image. (CVE-2023-26965)

  - A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.
    This flaw allows a local attacker to craft specific input data that can cause the program to dereference a     NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
    (CVE-2023-2731)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4736-1 advisory.

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted     TIFF image. (CVE-2023-26965)

  - A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.
    This flaw allows a local attacker to craft specific input data that can cause the program to dereference a     NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
    (CVE-2023-2731)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6512-1 advisory.

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

  - A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a     TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes     this memory leak issue, resulting an application crash, eventually leading to a denial of service.
    (CVE-2023-3576)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-351 advisory.

  - An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file. (CVE-2022-40090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198563	RHEL 8 : libtiff (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195071	Oracle Linux 9 : libtiff (ELSA-2024-2289)	Nessus	Oracle Linux Local Security Checks	medium
194805	RHEL 9 : libtiff (RHSA-2024:2289)	Nessus	Red Hat Local Security Checks	medium
189068	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2023-3184)	Nessus	Huawei Local Security Checks	medium
188998	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2023-3036)	Nessus	Huawei Local Security Checks	medium
188987	EulerOS Virtualization 2.10.0 : libtiff (EulerOS-SA-2023-3475)	Nessus	Huawei Local Security Checks	medium
188968	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2023-3013)	Nessus	Huawei Local Security Checks	medium
188810	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2023-3219)	Nessus	Huawei Local Security Checks	medium
188790	EulerOS Virtualization 2.10.1 : libtiff (EulerOS-SA-2023-3503)	Nessus	Huawei Local Security Checks	medium
188725	EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2023-3361)	Nessus	Huawei Local Security Checks	medium
188696	EulerOS Virtualization 2.11.0 : libtiff (EulerOS-SA-2023-3380)	Nessus	Huawei Local Security Checks	medium
188642	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2024-1012)	Nessus	Huawei Local Security Checks	medium
188575	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2023-3339)	Nessus	Huawei Local Security Checks	medium
188329	EulerOS Virtualization 2.9.1 : libtiff (EulerOS-SA-2024-1038)	Nessus	Huawei Local Security Checks	medium
188115	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2023-3307)	Nessus	Huawei Local Security Checks	medium
186935	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tiff (SUSE-SU-2023:4869-1)	Nessus	SuSE Local Security Checks	medium
186810	SUSE SLES12 Security Update : tiff (SUSE-SU-2023:4736-1)	Nessus	SuSE Local Security Checks	medium
186225	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-6512-1)	Nessus	Ubuntu Local Security Checks	medium
181700	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-351)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2022-40090

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium