According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.8, there is a heap-based buffer overflow     in the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution.(CVE-2017-9935)

  - LibTIFF before 4.0.6 mishandles the reading of TIFF     files, as demonstrated by a heap-based buffer over-read     in the ReadTIFFImage function in coders/tiff.c in     GraphicsMagick 1.3.27.(CVE-2018-5360)

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows     remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted TIFF file.(CVE-2017-17095)

  - TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a     heap-based buffer over-read, as demonstrated by     bmp2tiff.(CVE-2018-10779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In LibTIFF 4.0.8, there is a heap-based buffer overflow     in the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution.(CVE-2017-9935)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Debian Security Advisory reports :

Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.

This update for tiff fixes the following issues :

  - CVE-2017-9935: There was a heap-based buffer overflow in     the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution (bsc#1046077)

  - CVE-2017-17973: There is a heap-based use-after-free in     the t2p_writeproc function in tiff2pdf.c. (bsc#1074318)

  - CVE-2018-5784: There is an uncontrolled resource     consumption in the TIFFSetDirectory function of     tif_dir.c. Remote attackers could leverage this     vulnerability to cause a denial of service via a crafted     tif file. This occurs because the declared number of     directory entries is not validated against the actual     number of directory entries (bsc#1081690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

Security issue fixed :

CVE-2018-10779: TIFFWriteScanline in tif_write.c had a heap-based buffer over-read, as demonstrated by bmp2tiff.(bsc#1092480)

CVE-2018-17100: There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.
(bsc#1108637)

CVE-2018-17101: There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108627)

CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935.
(bsc#1110358)

CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209.
(bsc#1106853)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tiff fixes the following issues :

Security issue fixed :

  - CVE-2018-10779: TIFFWriteScanline in tif_write.c had a     heap-based buffer over-read, as demonstrated by     bmp2tiff.(bsc#1092480)

  - CVE-2018-17100: There is a int32 overflow in multiply_ms     in tools/ppm2tiff.c, which can cause a denial of service     (crash) or possibly have unspecified other impact via a     crafted image file. (bsc#1108637)

  - CVE-2018-17101: There are two out-of-bounds writes in     cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     image file. (bsc#1108627)

  - CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c     allowed remote attackers to cause a denial of service     (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     TIFF file, a similar issue to CVE-2017-9935.
    (bsc#1110358)

  - CVE-2018-16335: newoffsets handling in     ChopUpSingleUncompressedStrip in tif_dirread.c allowed     remote attackers to cause a denial of service     (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     TIFF file, as demonstrated by tiff2pdf. This is a     different vulnerability than CVE-2018-15209.
    (bsc#1106853)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3606-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tiff fixes the following issues :

  - CVE-2018-17100: There is a int32 overflow in multiply_ms     in tools/ppm2tiff.c, which can cause a denial of service     (crash) or possibly have unspecified other impact via a     crafted image file. (bsc#1108637)

  - CVE-2018-17101: There are two out-of-bounds writes in     cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can     cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     image file. (bsc#1108627)

  - CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c     allowed remote attackers to cause a denial of service     (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     TIFF file, a similar issue to CVE-2017-9935.
    (bsc#1110358)

  - CVE-2018-16335: newoffsets handling in     ChopUpSingleUncompressedStrip in tif_dirread.c allowed     remote attackers to cause a denial of service     (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     TIFF file, as demonstrated by tiff2pdf. This is a     different vulnerability than CVE-2018-15209.
    (bsc#1106853)

This update was imported from the SUSE:SLE-12:Update update project.

Added fixes for :

  - **CVE-2017-9935**

  - **CVE-2017-18013**

  - **CVE-2018-8905**

  - **CVE-2018-10963**

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1334 advisory.

    This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 9.6. It addresses 86 CVEs:
    CVE-2008-2327, CVE-2010-2067, CVE-2024-7006, CVE-2022-1355, CVE-2018-19210, and 81 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128909	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2019-1857)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	high
126424	EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2019-1683)	Nessus	Huawei Local Security Checks	2019/7/2	2024/5/13	high
106700	FreeBSD : tiff -- multiple vulnerabilities (b38e8150-0535-11e8-96ab-0800271d4b9c)	Nessus	FreeBSD Local Security Checks	2018/2/9	2025/10/30	high
109675	SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:1180-1)	Nessus	SuSE Local Security Checks	2018/5/10	2024/10/10	high
120140	SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2018:3327-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	high
123354	openSUSE Security Update : tiff (openSUSE-2019-847)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	high
108657	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3606-1)	Nessus	Ubuntu Local Security Checks	2018/3/27	2024/8/27	critical
118384	openSUSE Security Update : tiff (openSUSE-2018-1249)	Nessus	SuSE Local Security Checks	2018/10/25	2024/7/29	high
120824	Fedora 28 : libtiff (2018-d41d114d3e)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	high
355652	Rocky Linux 9.6 [CIQ] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ciqsa-2026_1334)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
129249	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2019-2056)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	high

检测

插件搜索

high

high

high

high

high

high

critical

high

high

high

high