According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5619-1 advisory.

    It was discovered that LibTIFF was not properly performing the calculation of data that would eventually     be used as a reference for bound-checking operations. An attacker could possibly use this issue to cause a     denial of service or to expose sensitive information. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2020-19131)

    It was discovered that LibTIFF was not properly terminating a function execution when processing incorrect     data. An attacker could possibly use this issue to cause a denial of service or to expose sensitive     information. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-19144)

    It was discovered that LibTIFF did not properly manage memory under certain circumstances. If a user were     tricked into opening a specially crafted TIFF file using tiffinfo tool, an attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2022-1354)

    It was discovered that LibTIFF did not properly manage memory under certain circumstances. If a user were     tricked into opening a specially crafted TIFF file using tiffcp tool, an attacker could possibly use this     issue to

    cause a denial of service. (CVE-2022-1355)

    It was discovered that LibTIFF was not properly performing checks to avoid division calculations where the     denominator value was zero, which could lead to an undefined behaviour situation via a specially crafted     file. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2056,     CVE-2022-2057, CVE-2022-2058)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-194 advisory.

    A divide-by-zero vulnerability was found in libtiff. This flaw allows an attacker to cause a denial of     service via a crafted tiff file. (CVE-2022-2056)

    A divide-by-zero vulnerability was found in libtiff. This flaw allows an attacker to cause a denial of     service via a crafted tiff file. (CVE-2022-2057)

    A divide-by-zero vulnerability was found in libtiff. This flaw allows an attacker to cause a denial of     service via a crafted tiff file. (CVE-2022-2058)

    A stack overflow flaw was found in the _TIFFVGetField function of Tiffsplit. This vulnerability allows     attackers to cause a denial of service (DoS) via a crafted TIFF file. (CVE-2022-34526)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164183	EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2022-2259)	Nessus	Huawei Local Security Checks	2022/8/17	2023/10/16	medium
165037	EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2022-2326)	Nessus	Huawei Local Security Checks	2022/9/14	2023/10/12	medium
165277	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : LibTIFF vulnerabilities (USN-5619-1)	Nessus	Ubuntu Local Security Checks	2022/9/21	2024/8/27	medium
165350	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2022-2388)	Nessus	Huawei Local Security Checks	2022/9/23	2023/10/11	medium
167001	Amazon Linux 2022 : libtiff, libtiff-devel, libtiff-static (ALAS2022-2022-194)	Nessus	Amazon Linux Local Security Checks	2022/11/4	2024/12/11	high

检测

插件搜索

medium

medium

medium

medium

high