Multiple vulnerabilities have been discovered in the libtiff library and the included tools tiff2rgba, rgb2ycbcr, tiffcp, tiffcrop, tiff2pdf and tiffsplit, which may result in denial of service, memory disclosure or the execution of arbitrary code.

There were additional vulnerabilities in the tools bmp2tiff, gif2tiff, thumbnail and ras2tiff, but since these were addressed by the libtiff developers by removing the tools altogether, no patches are available and those tools were also removed from the tiff package in Debian stable. The change had already been made in Debian stretch before and no applications included in Debian are known to rely on these scripts.
If you use those tools in custom setups, consider using a different conversion/thumbnailing tool.

An update for libtiff is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es) :

* Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files.
(CVE-2016-9533, CVE-2016-9534, CVE-2016-9535)

* Multiple flaws have been discovered in various libtiff tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2015-8870, CVE-2016-5652, CVE-2016-9540, CVE-2016-9537, CVE-2016-9536)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3212-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - apache
  - apache_mod_php
  - AppleGraphicsPowerManagement
  - AppleRAID
  - Audio
  - Bluetooth
  - Carbon
  - CoreGraphics
  - CoreMedia
  - CoreText
  - curl
  - EFI
  - FinderKit
  - FontParser
  - HTTPProtocol
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOATAFamily
  - IOFireWireAVC
  - IOFireWireFamily
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - LibreSSL
  - MCX Client
  - Menus
  - Multi-Touch
  - OpenSSH
  - OpenSSL
  - Printing
  - python
  - QuickTime
  - Security
  - SecurityFoundation
  - sudo
  - System Integrity Protection
  - tcpdump
  - tiffutil
  - WebKit

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1282:01 advisory.

    The libtiff package contains a library of functions for manipulating     TIFF (Tagged Image File Format) image format files.  TIFF is a widely     used file format for bitmapped images.  TIFF files usually end in the     .tif extension and they are often quite large.
    The libtiff package should be installed if you need to manipulate TIFF     format image files.
    Security issues fixed with this release:
    CVE-2015-8870     Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows     remote attackers to cause a denial of service (heap-based buffer     over-read), or possibly obtain sensitive information from process     memory, via crafted width and length values in RLE4 or RLE8 data in a     BMP file.
    CVE-2016-5652     An exploitable heap-based buffer overflow exists in the handling of     TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can     lead to a heap-based buffer overflow resulting in remote code     execution. Vulnerability can be triggered via a saved TIFF file     delivered by other means.
    CVE-2016-9533     tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities     in heap allocated buffers. Reported as MSVR 35094, aka PixarLog     horizontalDifference heap-buffer-overflow.
    CVE-2016-9534     tif_write.c in libtiff 4.0.6 has an issue in the error code path of     TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members.
    Reported as MSVR 35095, aka TIFFFlushData1 heap-buffer-overflow.
    CVE-2016-9535     tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that     can lead to assertion failures in debug mode, or buffer overflows in     release mode, when dealing with unusual tile size like YCbCr with     subsampling. Reported as MSVR 35105, aka Predictor     heap-buffer-overflow.
    CVE-2016-9536     tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write     vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip().
    Reported as MSVR 35098, aka t2p_process_jpeg_strip     heap-buffer-overflow.
    CVE-2016-9537     tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write     vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and     MSVR 35097.
    CVE-2016-9540     tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled     images with odd tile width versus image width. Reported as MSVR 35103,     aka cpStripToTile heap-buffer-overflow.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix patch for (CVE-2016-5652)

  - Related: #1412078

  - Fix CWE-476 defect found by covscan

  - Related: #1412078

  - Add patches for CVEs :

  - CVE-2016-9533 CVE-2016-9534 (CVE-2016-9535)

  - CVE-2016-9536 CVE-2016-9537 (CVE-2016-9540)

  - (CVE-2016-5652)

  - Resolves: #1412078

Security Fix(es) :

  - Multiple flaws have been discovered in libtiff. A remote     attacker could exploit these flaws to cause a crash or     memory corruption and, possibly, execute arbitrary code     by tricking an application linked against libtiff into     processing specially crafted files. (CVE-2016-9533,     CVE-2016-9534, CVE-2016-9535)

  - Multiple flaws have been discovered in various libtiff     tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By     tricking a user into processing a specially crafted     file, a remote attacker could exploit these flaws to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff tool. (CVE-2015-8870, CVE-2016-5652,     CVE-2016-9540, CVE-2016-9537, CVE-2016-9536)

Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files.
(CVE-2016-9533 , CVE-2016-9534 , CVE-2016-9535)

Multiple flaws have been discovered in various libtiff tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2015-8870 , CVE-2016-5652 , CVE-2016-9540 , CVE-2016-9537 , CVE-2016-9536)

This update for tiff fixes the following security issues :

  - CVE-2017-5225: Prevent heap buffer overflow in the     tools/tiffcp that could have caused DoS or code     execution via a crafted BitsPerSample value     (bsc#1019611)

  - CVE-2018-7456: Prevent a NULL pointer dereference in the     function TIFFPrintDirectory when using the tiffinfo tool     to print crafted TIFF information, a different     vulnerability than CVE-2017-18013 (bsc#1082825)

  - CVE-2017-11613: Prevent denial of service in the     TIFFOpen function. During the TIFFOpen process,     td_imagelength is not checked. The value of     td_imagelength can be directly controlled by an input     file. In the ChopUpSingleUncompressedStrip function, the
    _TIFFCheckMalloc function is called based on     td_imagelength. If the value of td_imagelength is set     close to the amount of system memory, it will hang the     system or trigger the OOM killer (bsc#1082332)

  - CVE-2016-10266: Prevent remote attackers to cause a     denial of service (divide-by-zero error and application     crash) via a crafted TIFF image, related to     libtiff/tif_read.c:351:22 (bsc#1031263)

  - CVE-2018-8905: Prevent heap-based buffer overflow in the     function LZWDecodeCompat via a crafted TIFF file     (bsc#1086408)

  - CVE-2016-9540: Prevent out-of-bounds write on tiled     images with odd tile width versus image width     (bsc#1011839).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - CVE-2016-9535: tif_predict.h and tif_predict.c had     assertions that could have lead to assertion failures in     debug mode, or buffer overflows in release mode, when     dealing with unusual tile size like YCbCr with     subsampling (bsc#1011846).

  - Removed assert in readSeparateTilesIntoBuffer() function     (bsc#1017689).

  - CVE-2016-10095: Prevent stack-based buffer overflow in     the _TIFFVGetField function that allowed remote     attackers to cause a denial of service (crash) via a     crafted TIFF file (bsc#1017690).

  - CVE-2016-8331: Prevent remote code execution because of     incorrect handling of TIFF images. A crafted TIFF     document could have lead to a type confusion     vulnerability resulting in remote code execution. This     vulnerability could have been be triggered via a TIFF     file delivered to the application using LibTIFF's tag     extension functionality (bsc#1007276).

  - CVE-2016-3632: The _TIFFVGetField function allowed     remote attackers to cause a denial of service     (out-of-bounds write) or execute arbitrary code via a     crafted TIFF image (bsc#974621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0225 advisory.

    - Fix patch for CVE-2016-5652
    - CVE-2016-9533 CVE-2016-9534 CVE-2016-9535
    - CVE-2016-9536 CVE-2016-9537 CVE-2016-9540
    - CVE-2016-5652

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libtiff project reports :

Multiple flaws have been discovered in libtiff library and utilities.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws have been discovered in libtiff. A     remote attacker could exploit these flaws to cause a     crash or memory corruption and, possibly, execute     arbitrary code by tricking an application linked     against libtiff into processing specially crafted     files. (CVE-2016-9533, CVE-2016-9534, CVE-2016-9535)

  - Multiple flaws have been discovered in various libtiff     tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By     tricking a user into processing a specially crafted     file, a remote attacker could exploit these flaws to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff tool. (CVE-2015-8870,     CVE-2016-5652, CVE-2016-9540, CVE-2016-9537,     CVE-2016-9536)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96495	Debian DSA-3762-1 : tiff - security update	Nessus	Debian Local Security Checks	2017/1/16	2026/1/5	critical
96948	RHEL 6 / 7 : libtiff (RHSA-2017:0225)	Nessus	Red Hat Local Security Checks	2017/2/2	2026/1/2	critical
97434	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3212-1)	Nessus	Ubuntu Local Security Checks	2017/2/28	2024/8/27	critical
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2025/12/26	critical
291585	MiracleLinux 7 : libtiff-4.0.3-27.el7 (AXSA:2017-1282:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
96946	OracleVM 3.4 : libtiff (OVMSA-2017-0036)	Nessus	OracleVM Local Security Checks	2017/2/2	2026/1/2	critical
96974	Scientific Linux Security Update : libtiff on SL6.x, SL7.x i386/x86_64 (20170201)	Nessus	Scientific Linux Local Security Checks	2017/2/3	2026/1/2	critical
97554	Amazon Linux AMI : libtiff / compat-libtiff3 (ALAS-2017-802)	Nessus	Amazon Linux Local Security Checks	2017/3/7	2025/12/30	critical
110803	SUSE SLES11 Security Update : tiff (SUSE-SU-2018:1835-1)	Nessus	SuSE Local Security Checks	2018/6/29	2024/9/10	critical
96929	CentOS 6 / 7 : libtiff (CESA-2017:0225)	Nessus	CentOS Local Security Checks	2017/2/2	2026/1/2	critical
96945	Oracle Linux 6 / 7 : libtiff (ELSA-2017-0225)	Nessus	Oracle Linux Local Security Checks	2017/2/2	2026/1/2	critical
96947	OracleVM 3.3 : libtiff (OVMSA-2017-0037)	Nessus	OracleVM Local Security Checks	2017/2/2	2026/1/2	critical
97035	FreeBSD : tiff -- multiple vulnerabilities (fb74eacc-ec8a-11e6-bc8a-0011d823eebd)	Nessus	FreeBSD Local Security Checks	2017/2/7	2026/1/1	critical
99865	EulerOS 2.0 SP1 : libtiff (EulerOS-SA-2017-1019)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical
99866	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2017-1020)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical