An update of the libtiff package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4634 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4634 advisory.

  - libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3902 advisory.

    - Fix CVE-2019-17546       Resolves: #1771371

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for **CVE-2019-17546**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5841-1 advisory.

    It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system     were tricked into opening a specially crafted image, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges. This issue was     only fixed in Ubuntu 14.04 ESM. (CVE-2019-14973, CVE-2019-17546, CVE-2020-35523, CVE-2020-35524,     CVE-2022-3970)

    It was discovered that LibTIFF was incorrectly acessing a data structure when processing data with the     tiffcrop tool, which could lead to a heap buffer overflow. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2022-48281)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0105 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14973:
    _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow     checks because they rely on compiler behavior that is undefined by the applicable C standards. This can,     for example, lead to an application crash.

    CVE-2019-17546:
    tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0105 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-14973:
    _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow     checks because they rely on compiler behavior that is undefined by the applicable C standards. This can,     for example, lead to an application crash.

    CVE-2019-17546:
    tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - tif_getimage.c in LibTIFF through 4.0.10, as used in     GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer     overflow via a crafted RGBA image, related to a     'Negative-size-param' condition.(CVE-2019-17546)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak     vulnerabilities, which allow attackers to cause a     denial of service (memory consumption), as demonstrated     by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third     parties were unable to reproduce the     issue.(CVE-2017-16232)

  - _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in     LibTIFF through 4.0.10 mishandle Integer Overflow     checks because they rely on compiler behavior that is     undefined by the applicable C standards. This can, for     example, lead to an application crash.(CVE-2019-14973)

  - An Invalid Address dereference was discovered in     TIFFWriteDirectoryTagTransferfunction in     libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the     cpSeparateBufToContigBuf function in tiffcp.c. Remote     attackers could leverage this vulnerability to cause a     denial-of-service via a crafted tiff file. This is     different from CVE-2018-12900.(CVE-2019-7663)

  - An issue was discovered in LibTIFF 4.0.9. There are two     out-of-bounds writes in cpTags in tools/tiff2bw.c and     tools/pal2rgb.c, which can cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted image file.(CVE-2018-17101)

  - An issue was discovered in LibTIFF 4.0.9. There is a     int32 overflow in multiply_ms in tools/ppm2tiff.c,     which can cause a denial of service (crash) or possibly     have unspecified other impact via a crafted image     file.(CVE-2018-17100)

  - An issue was discovered in LibTIFF 4.0.9. There is a     NULL pointer dereference in the function LZWDecode in     the file tif_lzw.c.(CVE-2018-18661)

  - Buffer overflow in the readgifimage function in     gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows     remote attackers to cause a denial of service     (segmentation fault) via a crafted gif     file.(CVE-2016-5102)

  - Heap-based buffer overflow in the     cpSeparateBufToContigBuf function in tiffcp.c in     LibTIFF 4.0.9 allows remote attackers to cause a denial     of service (crash) or possibly have unspecified other     impact via a crafted TIFF file.(CVE-2018-12900)

  - In LibTIFF 4.0.9, there is a NULL pointer dereference     in the TIFFWriteDirectorySec function in tif_dirwrite.c     that will lead to a denial of service attack, as     demonstrated by tiffset.(CVE-2018-19210)

  - LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField     function in tif_dir.c, which might allow remote     attackers to cause a denial of service (crash) via a     crafted TIFF file.(CVE-2017-9147)

  - LibTIFF 4.0.9 (with JBIG enabled) decodes     arbitrarily-sized JBIG into a buffer, ignoring the     buffer size, which leads to a tif_jbig.c JBIGDecode     out-of-bounds write.(CVE-2018-18557)

  - Stack-based buffer overflow in the _TIFFVGetField     function in libtiff 4.0.6 and earlier allows remote     attackers to crash the application via a crafted     tiff.(CVE-2016-5318)

  - The _TIFFFax3fillruns function in libtiff before 4.0.6     allows remote attackers to cause a denial of service     (divide-by-zero error and application crash) via a     crafted Tiff image.(CVE-2016-5323)

  - The cvtClump function in the rgb2ycbcr tool in LibTIFF     4.0.6 and earlier allows remote attackers to cause a     denial of service (out-of-bounds write) by setting the     '-v' option to -1.(CVE-2016-3624)

  - The DumpModeDecode function in libtiff 4.0.6 and     earlier allows attackers to cause a denial of service     (invalid read and crash) via a crafted tiff     image.(CVE-2016-5321)

  - The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows     remote attackers to cause a denial of service     (divide-by-zero) by setting the (1) v or (2) h     parameter to 0.(CVE-2016-3623)

  - The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10     has a memory leak, as demonstrated by     pal2rgb.(CVE-2019-6128)

  - The TIFFWriteDirectorySec() function in tif_dirwrite.c     in LibTIFF through 4.0.9 allows remote attackers to     cause a denial of service (assertion failure and     application crash) via a crafted file, a different     vulnerability than CVE-2017-13726.(CVE-2018-10963)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in     GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer     overflow via a crafted RGBA image, related to a     'Negative-size-param' condition.(CVE-2019-17546)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:4634 advisory.

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0496-1 advisory.

    - CVE-2017-17095: Fixed DoS in tools/pal2rgb.c in pal2rgb (bsc#1071031).
    - CVE-2019-17546: Fixed integer overflow that potentially causes a heap-based buffer overflow via a     crafted RGBA image (bsc#1154365).
    - CVE-2020-19131: Fixed buffer overflow in tiffcrop that may cause DoS via the invertImage() function     (bsc#1190312).
    - CVE-2020-35521: Fixed memory allocation failure in tif_read.c (bsc#1182808).
    - CVE-2020-35522: Fixed memory allocation failure in tif_pixarlog.c (bsc#1182809).
    - CVE-2020-35523: Fixed integer overflow in tif_getimage.c (bsc#1182811).
    - CVE-2020-35524: Fixed heap-based buffer overflow in TIFF2PDF tool (bsc#1182812).
    - CVE-2022-22844: Fixed out-of-bounds read in _TIFFmemcpy in tif_unix.c (bsc#1194539).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0480-1 advisory.

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and application crash) or possibly have unspecified other     impact via a crafted TIFF file. (CVE-2017-17095)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

  - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the invertImage()     function in the component tiffcrop. (CVE-2020-19131)

  - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can     lead to an abort, resulting in denial of service. (CVE-2020-35521)

  - In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an     abort, resulting in a remote denial of service attack. (CVE-2020-35522)

  - An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

  - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's     TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3902 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: integer overflow in _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c (CVE-2019-14973)

    * libtiff: integer overflow leading to heap-based buffer overflow in tif_getimage.c (CVE-2019-17546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by a vulnerability:

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libtiff packages installed that are affected by multiple vulnerabilities:

  - _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow     checks because they rely on compiler behavior that is undefined by the applicable C standards. This can,     for example, lead to an application crash. (CVE-2019-14973)

  - tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer     overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a     Negative-size-param condition. (CVE-2019-17546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several issues have been found in tiff, a Tag Image File Format library.

CVE-2019-17546

The RGBA interface contains an integer overflow that might lead to heap buffer overflow write.

CVE-2019-6128

A memory leak exists due to missing cleanup code.

CVE-2018-18661

In case of exhausted memory there is a NULL pointer dereference in tiff2bw.

CVE-2018-12900

Fix for heap-based buffer overflow, that could be used to crash an application or even to execute arbitrary code (with the permission of the user running this application).

CVE-2017-17095

A crafted tiff file could lead to a heap buffer overflow in pal2rgb.

For Debian 8 'Jessie', these problems have been fixed in version 4.0.3-12.3+deb8u10.

We recommend that you upgrade your tiff packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
133264	Photon OS 2.0: Libtiff PHSA-2020-2.0-0202	Nessus	PhotonOS Local Security Checks	2020/1/27	2024/7/22	high
142442	RHEL 8 : libtiff (RHSA-2020:4634)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	high
145898	CentOS 8 : libtiff (CESA-2020:4634)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	high
141236	Oracle Linux 7 : libtiff (ELSA-2020-3902)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/11/1	high
134249	Fedora 31 : libtiff (2020-2e9bd06377)	Nessus	Fedora Local Security Checks	2020/3/6	2024/3/25	high
170966	Ubuntu 16.04 ESM : LibTIFF vulnerabilities (USN-5841-1)	Nessus	Ubuntu Local Security Checks	2023/2/2	2024/8/27	high
256523	Linux Distros Unpatched Vulnerability : CVE-2019-17546	Nessus	Misc.	2025/8/27	2026/7/20	high
236703	Alibaba Cloud Linux 3 : 0105: libtiff (ALINUX3-SA-2022:0105)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
239499	TencentOS Server 3: libtiff (TSSA-2022:0105)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
131354	EulerOS 2.0 SP8 : libtiff (EulerOS-SA-2019-2288)	Nessus	Huawei Local Security Checks	2019/11/27	2024/4/9	high
132156	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2019-2621)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	high
157616	AlmaLinux 8 : libtiff (ALSA-2020:4634)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	high
158189	SUSE SLES12 Security Update : tiff (SUSE-SU-2022:0496-1)	Nessus	SuSE Local Security Checks	2022/2/19	2026/6/26	high
158234	openSUSE 15 Security Update : tiff (openSUSE-SU-2022:0480-1)	Nessus	SuSE Local Security Checks	2022/2/22	2022/5/6	high
141047	RHEL 7 : libtiff (RHSA-2020:3902)	Nessus	Red Hat Local Security Checks	2020/9/30	2024/11/7	high
147308	NewStart CGSL MAIN 6.02 : libtiff Vulnerability (NS-SA-2021-0058)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/10	high
147372	NewStart CGSL CORE 5.04 / MAIN 5.04 : libtiff Multiple Vulnerabilities (NS-SA-2021-0014)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	high
131328	Debian DLA-2009-1 : tiff security update	Nessus	Debian Local Security Checks	2019/11/27	2024/4/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high