According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash. (CVE-2023-6228)

  - An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a     remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
    (CVE-2023-6277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0336 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2018-15209:
    ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact     via a crafted TIFF file, as demonstrated by tiff2pdf.

    CVE-2023-6228:
    An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash.

    CVE-2023-25433:
    libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of     buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.

    CVE-2023-52356:
    A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users,     during install/upgrade workflow, to replace one of the Agent's executables before it can be executed. This     allows the user to elevate their permissions. (CVE-2023-0975)

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow. (CVE-2023-40745)

  - A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow. (CVE-2023-41175)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0106 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-40090:
    An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a     denial of service via crafted TIFF file.

    CVE-2023-3618:
    A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a     buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.

    CVE-2023-40745:
    LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow.

    CVE-2023-41175:
    A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow.

    CVE-2023-6228:
    An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing may cause a heap-based buffer overflow leads to an application crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libtiff installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-6228 advisory.

  - An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on     processing May cause a heap-based buffer overflow leads to an application crash. (CVE-2023-6228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5079 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)

    * libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5079 advisory.

    * libtiff: Heap-based buffer overflow in ChopUpSingleUncompressedStrip in tif_dirread.c (CVE-2018-15209)
    * libtiff: Buffer Overflow via /libtiff/tools/tiffcrop.c (CVE-2023-25433)
    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)
    * libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service     (CVE-2023-52356)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f19c79e713 advisory.

    Automatic update for libtiff-4.6.0-6.fc41.

    ##### **Changelog**

    ```
    * Wed Aug 14 2024 Michal Hlavinka <mhlavink@redhat.com> - 4.6.0-6
    - fix CVE-2024-7006 (rhbz#2302997)
    - fix CVE-2023-52356 (rhbz#2260112)
    - fix CVE-2023-6228 (rhbz#2251863)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2289 advisory.

    - Fix CVE-2023-6228
    - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
192439	EulerOS Virtualization 2.9.1 : libtiff (EulerOS-SA-2024-1456)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	medium
276253	TencentOS Server 3: libtiff (TSSA-2024:0336)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
242726	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0128)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
236104	Alibaba Cloud Linux 3 : 0106: libtiff (ALINUX3-SA-2024:0106)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
235332	Azure Linux 3.0 Security Update: libtiff (CVE-2023-6228)	Nessus	Azure Linux Local Security Checks	2025/5/6	2025/9/15	low
205156	RHEL 8 : libtiff (RHSA-2024:5079)	Nessus	Red Hat Local Security Checks	2024/8/7	2024/11/7	high
205209	AlmaLinux 8 : libtiff (ALSA-2024:5079)	Nessus	Alma Linux Local Security Checks	2024/8/8	2024/8/8	high
211063	Fedora 41 : libtiff (2024-f19c79e713)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
192089	EulerOS Virtualization 2.10.1 : libtiff (EulerOS-SA-2024-1361)	Nessus	Huawei Local Security Checks	2024/3/14	2024/3/14	medium
192335	EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2024-1416)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	medium
192438	EulerOS Virtualization 2.9.0 : libtiff (EulerOS-SA-2024-1471)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	medium
195071	Oracle Linux 9 : libtiff (ELSA-2024-2289)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	medium

检测

插件搜索

medium

high

high

medium

low

high

high

high

medium

medium

medium

medium