リモート Redhat Enterprise Linux 9 ホストに、RHSA-2025:20801 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    libtiff パッケージには、TIFF (Tagged Image File Format) ファイルを操作するための関数のライブラリが含まれます。

    セキュリティ修正プログラム:

    * libtiff: TIFFRasterScanlineSize64 が過大なサイズを生成し、OOM を引き起こす可能性がある (CVE-2023-52355)

    * libtiff: サービス拒否を引き起こす TIFFReadRGBATileExt() の libtiff のセグメント障害 (CVE-2023-52356)

    影響、CVSS スコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

    追加の変更

    このリリースの変更に関する詳細については、「参照」セクションからリンクされている Red Hat Enterprise Linux 9 リリースノートを参照してください。

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Oracle Linux 9 主機中安裝的套件受到 ELSA-2025-20801 公告中提及的多個弱點影響。

    - 反向移植 CVE-2023-52355 的文件變更 (RHEL-17328)

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2025:20801 公告中提及的多個弱點影響。

    libtiff 套件中包含可操控標記影像檔案格式 (TIFF) 檔案的函式程式庫。

    安全性修正：

    * libtiff：TIFFRasterScanlineSize64 產生過大尺寸，並且可能造成 OOM (CVE-2023-52355)

    * libtiff：TIFFReadRGBATileExt() 的 libtiff 中的區段錯誤導致拒絕服務 (CVE-2023-52356)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

    其他變更：

    如需有關此發行版本的詳細變更資訊，請參閱可從「參照」一節連結的 Red Hat Enterprise Linux 9 版本資訊。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 9 主机上安装的程序包受到 RHSA-2025:20801 公告中提及的多个漏洞影响。

    libtiff 程序包中包含用于操纵标记图像文件格式 (TIFF) 文件的函数库。

    安全修复：

    * libtiff：TIFFRasterScanlineSize64 生成的结果尺寸过大并可造成 OOM 问题 (CVE-2023-52355)

    * libtiff：TIFFReadRGBATileExt() 中的 libtiff 存在段错误，因而可导致拒绝服务 (CVE-2023-52356)

    有关上述安全问题的更多详细信息，包括其影响、CVSS 得分、致谢，以及其他相关信息，请参阅列于“参考”部分的 CVE 页面。

    其他变更：

    如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 9 发行说明。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

リモートの Oracle Linux 9 ホストに、ELSA-2025-20801アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    - CVE-2023-52355 に対するドキュメントの変更をバックポートRHEL-17328]

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

An update of the libtiff package has been released.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20801 advisory.

    - backport documentation change for CVE-2023-52355 (RHEL-17328)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 Oracle Linux 9 主机上安装的程序包受到 ELSA-2025-20801 公告中提及的多个漏洞影响。

    - CVE-2023-52355 的向后移植文档更改 (RHEL-17328)

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - libtiff にメモリ不足の欠陥が見つかりました。これは、細工された tiff ファイルを TIFFRasterScanlineSize64() API に渡すことで発生する可能性があります。この欠陥により、リモートの攻撃者は 379 KB より小さいサイズの細工された入力を介してサービス拒否を引き起こすことができます。CVE-2023-52355

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0181 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-52355:
    An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB.

    CVE-2023-52356:
    A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users,     during install/upgrade workflow, to replace one of the Agent's executables before it can be executed. This     allows the user to elevate their permissions. (CVE-2023-0975)

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow. (CVE-2023-40745)

  - A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow. (CVE-2023-41175)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 libtiff 中发现一个内存不足缺陷可通过将构建的 tiff 文件传递至 TIFFRasterScanlineSize64() API 来触发。此缺陷允许远程攻击者通过构建的小于 379 KB 的输入造成拒绝服务。 (CVE-2023-52355)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 libtiff 中發現一個記憶體不足瑕疵傳送特製 tiff 檔案至 TIFFRasterScanlineSize64() API 時可觸發該瑕疵。此瑕疵可讓遠端攻擊者透過大小小於 379 KB 的特製輸入造成拒絕服務。 (CVE-2023-52355)

請注意，Nessus 依賴供應商報告的套件存在。

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20801 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)

    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0784 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-6277:
    An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a     remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.

    CVE-2023-52356:
    A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service.

    CVE-2023-52355:
    An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB.

    CVE-2023-6228:
    An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service. (CVE-2023-52356)

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
274775	RHEL 9 : libtiff (RHSA-2025:20801)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
276690	Oracle Linux 9：libtiff (ELSA-2025-20801)	Nessus	Oracle Linux Local Security Checks	2025/11/25	2025/11/25	high
274775	RHEL 9：libtiff (RHSA-2025:20801)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
274775	RHEL 9：libtiff (RHSA-2025:20801)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
276690	Oracle Linux 9 : libtiff (ELSA-2025-20801)	Nessus	Oracle Linux Local Security Checks	2025/11/25	2025/11/25	high
204333	Photon OS 4.0: Libtiff PHSA-2024-4.0-0558	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
276690	Oracle Linux 9 : libtiff (ELSA-2025-20801)	Nessus	Oracle Linux Local Security Checks	2025/11/25	2025/11/25	high
276690	Oracle Linux 9：libtiff (ELSA-2025-20801)	Nessus	Oracle Linux Local Security Checks	2025/11/25	2025/11/25	high
227328	Linux Distros のパッチ未適用の脆弱性: CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/12/10	high
275561	Alibaba Cloud Linux 3 : 0181: libtiff (ALINUX3-SA-2025:0181)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/11/17	2025/11/17	high
242726	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0128)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
227328	Linux Distros 未修补的漏洞：CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/12/10	high
227328	Linux Distros Unpatched Vulnerability : CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/12/10	high
227328	Linux Distros 未修補的弱點：CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/12/10	high
274775	RHEL 9 : libtiff (RHSA-2025:20801)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
239578	TencentOS Server 4: libtiff (TSSA-2024:0784)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
203881	Photon OS 3.0: Libtiff PHSA-2024-3.0-0719	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
204151	Photon OS 5.0: Libtiff PHSA-2024-5.0-0196	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
237995	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0070)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high