The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3711 advisory.

    - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804       CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799       CVE-2022-48281

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3827 advisory.

    - Fix CVE-2022-48281

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6290-1 advisory.

    It was discovered that LibTIFF could be made to write out of bounds when processing certain malformed     image files with the tiffcrop utility. If a user were tricked into opening a specially crafted image file,     an attacker could possibly use this issue to cause tiffcrop to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu     22.04 LTS. (CVE-2022-48281)

    It was discovered that LibTIFF incorrectly handled certain image files. If a user were tricked into     opening a specially crafted image file, an attacker could possibly use this issue to cause a denial of     service. This issue only affected Ubuntu 23.04. (CVE-2023-2731)

    It was discovered that LibTIFF incorrectly handled certain image files with the tiffcp utility. If a user     were tricked into opening a specially crafted image file, an attacker could possibly use this issue to     cause tiffcp to crash, resulting in a denial of service. (CVE-2023-2908)

    It was discovered that LibTIFF incorrectly handled certain file paths. If a user were tricked into     specifying certain output paths, an attacker could possibly use this issue to cause a denial of service.
    This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3316)

    It was discovered that LibTIFF could be made to write out of bounds when processing certain malformed     image files. If a user were tricked into opening a specially crafted image file, an attacker could     possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2023-3618)

    It was discovered that LibTIFF could be made to write out of bounds when processing certain malformed     image files. If a user were tricked into opening a specially crafted image file, an attacker could     possibly use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-25433, CVE-2023-26966)

    It was discovered that LibTIFF did not properly managed memory when processing certain malformed image     files with the tiffcrop utility. If a user were tricked into opening a specially crafted image file, an     attacker could possibly use this issue to cause tiffcrop to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu     23.04. (CVE-2023-26965)

    It was discovered that LibTIFF contained an arithmetic overflow. If a user were tricked into opening a     specially crafted image file, an attacker could possibly use this issue to cause a denial of service.
    (CVE-2023-38288, CVE-2023-38289)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-364 advisory.

    LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604,     allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff     from sources, the fix is available with commit cfbb883b. (CVE-2022-3598)

    processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

    A vulnerability was found in libtiff library. This security flaw causes a heap buffer overflow in     extractContigSamples32bits, tiffcrop.c (CVE-2023-30775)

    Multiple potential integer overflow in tiffcp.c in libtiff <= 4.5.1 can allow remote attackers to cause a     denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which     triggers a heap-based buffer overflow. (CVE-2023-40745)

    Multiple potential integer overflow in raw2tiff.c in libtiff <= 4.5.1 can allow remote attackers to cause     a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image     which triggers a heap-based buffer overflow. (CVE-2023-41175)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6110:05 advisory.

    * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281)
      * libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795)
      * libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796)
      * libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in     tools/tiffcrop.c (CVE-2023-0797)
      * libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798)
      * libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799)
      * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c     (CVE-2023-0800)
      * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in     tools/tiffcrop.c (CVE-2023-0801)
      * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c     (CVE-2023-0802)
      * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c     (CVE-2023-0803)
      * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c     (CVE-2023-0804)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
177493	Oracle Linux 9 : libtiff (ELSA-2023-3711)	Nessus	Oracle Linux Local Security Checks	2023/6/22	2025/9/9	medium
177774	Oracle Linux 8 : libtiff (ELSA-2023-3827)	Nessus	Oracle Linux Local Security Checks	2023/6/29	2025/9/9	medium
179893	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : LibTIFF vulnerabilities (USN-6290-1)	Nessus	Ubuntu Local Security Checks	2023/8/16	2025/9/3	medium
182455	Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-364)	Nessus	Amazon Linux Local Security Checks	2023/10/3	2024/12/11	medium
225246	Linux Distros Unpatched Vulnerability : CVE-2022-48281	Nessus	Misc.	2025/3/5	2025/9/3	medium
293165	MiracleLinux 9 : libtiff-4.4.0-8.el9 (AXSA:2023-6110:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium