The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service     (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an     extension tag in a TIFF image. (CVE-2015-7554)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201701-16 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libTIFF. Please review       the CVE identifier and bug reports referenced for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       image file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for tiff fixes the following issues :

  - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783:
    Out-of-bounds writes for invalid images (bsc#964225)

  - CVE-2015-7554: Out-of-bounds Write in the thumbnail and     tiffcmp tools (bsc#960341)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3212-1 and USN-3212-2 fixed a vulnerabilitiy in LibTIFF. This update provides a subset of corresponding update for Ubuntu 12.04 ESM.

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The (1) putcontig8bitYCbCr21tile function in     tif_getimage.c or (2) NeXTDecode function in tif_next.c     in LibTIFF allows remote attackers to cause a denial of     service (uninitialized memory access) via a crafted     TIFF image, as demonstrated by libtiff-cvs-1.tif and     libtiff-cvs-2.tif.(CVE-2014-8127,CVE-2014-8129,CVE-2014
    -8130,CVE-2014-9655)

  - A flaw was discovered in the bmp2tiff utility. By     tricking a user into processing a specially crafted     file, a remote attacker could exploit this flaw to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff     tool.(CVE-2014-9330,CVE-2015-7554,CVE-2015-8668,CVE-201     5-8665,CVE-2015-8781,CVE-2016-3632,CVE-2016-3945,CVE-20     16-3990,CVE-2016-3991,CVE-2016-5320,CVE-2016-5652,CVE-2     015-8683)

  - tools/tiffcp.c in libtiff has an out-of-bounds write on     tiled images with odd tile width versus image width.
    Reported as MSVR 35103, aka 'cpStripToTile     heap-buffer-overflow.'(CVE-2016-9540)

  - tif_predict.h and tif_predict.c in libtiff have     assertions that can lead to assertion failures in debug     mode, or buffer overflows in release mode, when dealing     with unusual tile size like YCbCr with subsampling.
    Reported as MSVR 35105, aka 'Predictor     heap-buffer-overflow.'(CVE-2016-9535,CVE-2016-9533,CVE-     2016-9534,CVE-2016-9536,CVE-2016-9537)

  - The NeXTDecode function in tif_next.c in LibTIFF allows     remote attackers to cause a denial of service     (uninitialized memory access) via a crafted TIFF image,     as demonstrated by libtiff5.tif.(CVE-2015-1547)

  - The NeXTDecode function in tif_next.c in LibTIFF allows     remote attackers to cause a denial of service     (out-of-bounds write) via a crafted TIFF image, as     demonstrated by libtiff5.tif.(CVE-2015-8784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to tiff 4.0.6 fixes the following issues :

  - CVE-2015-7554: Out-of-bounds write in the thumbnail and     tiffcmp tools allowed attacker to cause a denial of     service or have unspecified further impact (bsc#960341)

  - bsc#942690: potential out-of-bound write in NeXTDecode()     (#2508)

This update was imported from the SUSE:SLE-12:Update update project.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update patch for (CVE-2014-8127)

  - Related: #1335099

  - Fix patches for (CVE-2016-3990, CVE-2016-5320)

  - Related: #1335099

  - Add patches for CVEs :

  - CVE-2016-3632 CVE-2016-3945 (CVE-2016-3990)

  - CVE-2016-3991 (CVE-2016-5320)

  - Related: #1335099

  - Update patch for (CVE-2014-8129)

  - Related: #1335099

  - Merge previously released fixes for CVEs :

  - CVE-2013-1960 CVE-2013-1961 (CVE-2013-4231)

  - CVE-2013-4232 CVE-2013-4243 (CVE-2013-4244)

  - Resolves: #1335099

  - Patch typos in (CVE-2014-8127)

  - Related: #1299919

  - Fix CVE-2014-8127 and CVE-2015-8668 patches

  - Related: #1299919

  - Fixed patches on preview CVEs

  - Related: #1299919

  - This resolves several CVEs

  - CVE-2014-8127, CVE-2014-8129, (CVE-2014-8130)

  - CVE-2014-9330, CVE-2014-9655, (CVE-2015-8781)

  - CVE-2015-8784, CVE-2015-1547, (CVE-2015-8683)

  - CVE-2015-8665, CVE-2015-7554, (CVE-2015-8668)

  - Resolves: #1299919

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2016:1546-1 advisory.

    Security Fix(es):
    * Multiple flaws have been discovered in libtiff. A remote attacker could     exploit these flaws to cause a crash or memory corruption and, possibly,     execute arbitrary code by tricking an application linked against libtiff     into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547,     CVE-2015-8784, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782,     CVE-2015-8783, CVE-2016-3990, CVE-2016-5320)
    * Multiple flaws have been discovered in various libtiff tools (bmp2tiff,     pal2rgb, thumbnail, tiff2bw, tiff2pdf, tiffcrop, tiffdither, tiffsplit,     tiff2rgba). By tricking a user into processing a specially crafted file, a     remote attacker could exploit these flaws to cause a crash or memory     corruption and, possibly, execute arbitrary code with the privileges of     the user running the libtiff tool. (CVE-2014-8127, CVE-2014-8129,     CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632,     CVE-2016-3945, CVE-2016-3991)


Tenable has extracted the preceding description block directly from the Scientific Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Applications using libtiff can trigger buffer overflows through TIFFGetField() when processing TIFF images with unknown tags.

For Debian 7 'Wheezy', these problems have been fixed in version 3.9.6-11+deb7u2.

We recommend that you upgrade your tiff3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
219047	Linux Distros Unpatched Vulnerability : CVE-2015-7554	Nessus	Misc.	2025/3/4	2026/7/20	critical
96373	GLSA-201701-16 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/10	2026/1/6	critical
88677	SUSE SLED11 / SLES11 Security Update : tiff (SUSE-SU-2016:0353-1)	Nessus	SuSE Local Security Checks	2016/2/10	2021/1/6	critical
101833	Ubuntu 12.04 LTS : tiff vulnerabilities (USN-3212-3)	Nessus	Ubuntu Local Security Checks	2017/7/20	2025/12/9	critical
99889	EulerOS 2.0 SP1 : compat-libtiff3 (EulerOS-SA-2017-1044)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical
88394	openSUSE Security Update : tiff (openSUSE-2016-101)	Nessus	SuSE Local Security Checks	2016/1/27	2021/1/19	critical
92691	OracleVM 3.3 / 3.4 : libtiff (OVMSA-2016-0093)	Nessus	OracleVM Local Security Checks	2016/8/3	2026/1/29	critical
92720	Scientific Linux Security Update : libtiff on 7.x i686/x86_64 (2016:1546)	Nessus	Scientific Linux Local Security Checks	2016/8/4	2025/8/29	critical
94473	Debian DLA-692-1 : tiff3 security update	Nessus	Debian Local Security Checks	2016/11/3	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical