An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f19c79e713 advisory.

    Automatic update for libtiff-4.6.0-6.fc41.

    ##### **Changelog**

    ```
    * Wed Aug 14 2024 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6
    - fix CVE-2024-7006 (rhbz#2302997)
    - fix CVE-2023-52356 (rhbz#2260112)
    - fix CVE-2023-6228 (rhbz#2251863)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9c84a7c963 advisory.

    - fix CVE-2024-7006 (rhbz#2302997)
    - fix CVE-2023-52356 (rhbz#2260112)
    - fix CVE-2023-6228 (rhbz#2251863)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5079 advisory.

    * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)

    * libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5079 advisory.

    * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)
    * libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)
    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)
    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5079 advisory.

    - Fix CVE-2023-6228 CVE-2023-52356 CVE-2023-25433 CVE-2018-15209

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5079 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)

    * libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2289 advisory.

    - Fix CVE-2023-6228
    - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2289 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)

    * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)

    * libtiff: integer overflow in tiffcp.c (CVE-2023-40745)

    * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash. (CVE-2023-6228)

  - An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a     remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
    (CVE-2023-6277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6644-2 advisory.

    USN-6644-1 fixed vulnerabilities in LibTIFF. This update provides the corresponding updates for Ubuntu     22.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6644-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a     specially crafted file, an attacker could possibly use this issue to cause the application to crash,     resulting in a denial of service. (CVE-2023-52356)

    It was discovered that LibTIFF incorrectly handled certain image files with the tiffcp utility. If a user     were tricked into opening a specially crafted image file, an attacker could possibly use this issue to     cause tiffcp to crash, resulting in a denial of service. (CVE-2023-6228)

    It was discovered that LibTIFF incorrectly handled certain files. If a user were tricked into opening a     specially crafted file, an attacker could possibly use this issue to cause the application to consume     resources, resulting in a denial of service. (CVE-2023-6277)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash. (CVE-2023-6228)

  - An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a     remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
    (CVE-2023-6277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
211063	Fedora 41 : libtiff (2024-f19c79e713)	Nessus	Fedora Local Security Checks	high
209644	Fedora 40 : libtiff (2024-9c84a7c963)	Nessus	Fedora Local Security Checks	high
206047	Rocky Linux 8 : libtiff (RLSA-2024:5079)	Nessus	Rocky Linux Local Security Checks	high
205209	AlmaLinux 8 : libtiff (ALSA-2024:5079)	Nessus	Alma Linux Local Security Checks	high
205162	Oracle Linux 8 : libtiff (ELSA-2024-5079)	Nessus	Oracle Linux Local Security Checks	high
205156	RHEL 8 : libtiff (RHSA-2024:5079)	Nessus	Red Hat Local Security Checks	high
195071	Oracle Linux 9 : libtiff (ELSA-2024-2289)	Nessus	Oracle Linux Local Security Checks	medium
194805	RHEL 9 : libtiff (RHSA-2024:2289)	Nessus	Red Hat Local Security Checks	medium
192439	EulerOS Virtualization 2.9.1 : libtiff (EulerOS-SA-2024-1456)	Nessus	Huawei Local Security Checks	medium
192438	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2024-1471)	Nessus	Huawei Local Security Checks	medium
192376	EulerOS Virtualization 2.11.0 : libtiff (EulerOS-SA-2024-1444)	Nessus	Huawei Local Security Checks	medium
192335	EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2024-1416)	Nessus	Huawei Local Security Checks	medium
192089	EulerOS Virtualization 2.10.1 : libtiff (EulerOS-SA-2024-1361)	Nessus	Huawei Local Security Checks	medium
192079	EulerOS Virtualization 2.10.0 : libtiff (EulerOS-SA-2024-1382)	Nessus	Huawei Local Security Checks	medium
191065	Ubuntu 22.04 LTS : LibTIFF vulnerabilities (USN-6644-2)	Nessus	Ubuntu Local Security Checks	high
190713	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 23.10 : LibTIFF vulnerabilities (USN-6644-1)	Nessus	Ubuntu Local Security Checks	high
190291	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2024-1179)	Nessus	Huawei Local Security Checks	medium
190253	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2024-1199)	Nessus	Huawei Local Security Checks	medium
189688	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2024-1108)	Nessus	Huawei Local Security Checks	medium
189687	EulerOS 2.0 SP11 : libtiff (EulerOS-SA-2024-1123)	Nessus	Huawei Local Security Checks	medium
188971	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2024-1088)	Nessus	Huawei Local Security Checks	medium
188777	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2024-1064)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2023-6228

low

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium