Fixes LZW decoding vulnerabilities described in CVE-2008-2327

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

SL4: A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

SL4 &amp; SL5: Additionally, these updated packages fix the following bug :

  - the libtiff packages included manual pages for the     sgi2tiff and tiffsv commands, which are not included in     these packages. These extraneous manual pages were     removed.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0452 advisory.

    This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 9.2. It addresses 74 CVEs:
    CVE-2010-2067, CVE-2018-19210, CVE-2013-4231, CVE-2017-9935, CVE-2013-1961, and 69 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0090 advisory.

    This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 8.6. It addresses 56 CVEs:
    CVE-2010-2067, CVE-2008-2327, CVE-2024-7006, CVE-2018-18661, CVE-2009-5022, and 51 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.5. 

Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2008-91:01 advisory.

    The libtiff package contains a library of functions for manipulating     TIFF (Tagged Image File Format) image format files.  TIFF is a widely     used file format for bitmapped images.  TIFF files usually end in the     .tif extension and they are often quite large.
    CVE-2008-2327 libtiff:
    use of uninitialized memory in LZW decoder. Multiple buffer underflows in the (1)  ZWDecode and (2)     LZWDecodeCompat functions in tif_lzw.c in the LZW decoder in  ibTIFF 3.8.2 and earlier allow context-     dependent attackers to execute arbitrary code via a crafted TIFF file.
    NOTE: some of these details are obtained from third party information.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix buffer overrun risks caused by unchecked integer     overflow (CVE-2009-2347) Resolves: #507725

  - Fix some more LZW decoding vulnerabilities     (CVE-2009-2285) Resolves: #507725

  - Update upstream URL

  - Use -fno-strict-aliasing per rpmdiff recommendation

  - Fix LZW decoding vulnerabilities (CVE-2008-2327)     Resolves: #458812

  - Remove sgi2tiff.1 and tiffsv.1, since they are for     programs we don't ship Resolves: #460120

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1334 advisory.

    This advisory aggregates security fixes for the libtiff SRPM in CIQ LTS 9.6. It addresses 86 CVEs:
    CVE-2008-2327, CVE-2010-2067, CVE-2024-7006, CVE-2022-1355, CVE-2018-19210, and 81 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues :

  - Safari includes a version of zlib that is affected by     multiple vulnerabilities. (CVE-2005-2096)

  - A heap-based buffer overflow issue in the libxslt library     could lead to a crash or arbitrary code execution.
    (CVE-2008-1767)

  - A signedness issue in Safari's handling of JavaScript     array indices could lead to a crash or arbitrary code     execution. (CVE-2008-2303)

  - A memory corruption issue in WebCore's handling of style     sheet elements could lead to a crash or arbitrary code     execution. (CVE-2008-2317)

  - Multiple uninitialized memory access issues in libTIFF's     handling of LZW-encoded TIFF images could lead to a     crash or arbitrary code execution. (CVE-2008-2327)

  - A memory corruption issue in ImageIO's handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2008-2332).

  - A memory corruption issue in ImageIO's handling of     embedded ICC profiles in JPEG images could lead to a     crash or arbitrary code execution. (CVE-2008-3608)

  - A heap-based buffer overflow in CoreGraphics' handling     of color spaces could lead to a crash or arbitrary code     execution. (CVE-2008-3623)

  - A buffer overflow in the handling of images with an     embedded ICC profile could lead to a crash or arbitrary     code execution. (CVE-2008-3642)

  - Disabling autocomplete on a form field may not prevent     the data in the field from being stored in the browser     page cache. (CVE-2008-3644)

  - WebKit's plug-in interface does not block plug-ins from     launching local URLs, which could allow a remote     attacker to launch local files in Safari and lead to the     disclosure of sensitive information. (CVE-2008-4216)

Drew Yao discovered that libTIFF, a library for handling the Tagged Image File Format, is vulnerable to a programming error allowing malformed tiff files to lead to a crash or execution of arbitrary code.

Updated libtiff packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2008:0863 :

Updated libtiff packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

ID	名稱	產品	系列	已發布	已更新	嚴重性
34129	Fedora 8 : libtiff-3.8.2-11.fc8 (2008-7388)	Nessus	Fedora Local Security Checks	2008/9/10	2021/1/11	medium
60471	Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
356554	Rocky Linux 9.2 [CIQ] Security Update: libtiff / libtiff-debuginfo / libtiff-debugsource / libtiff-devel / etc Multiple Vulnerabilities (ciqsa-2026_0452)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
359077	Rocky Linux 8.6 [CIQ] Security Update: libtiff / libtiff-debuginfo / libtiff-debugsource / libtiff-devel / etc Multiple Vulnerabilities (ciqsa-2026_0090)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	high
34211	Mac OS X 10.5.x < 10.5.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2008/9/16	2024/5/28	critical
284002	MiracleLinux 3 : libtiff-3.8.2-7.2 (AXSA:2008-91:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
79467	OracleVM 2.1 : libtiff (OVMSA-2009-0027)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/14	high
34064	RHEL 4 : libtiff (RHSA-2008:0848)	Nessus	Red Hat Local Security Checks	2008/8/30	2021/1/14	high
355652	Rocky Linux 9.6 [CIQ] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ciqsa-2026_1334)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
34772	Safari < 3.2 Multiple Vulnerabilities	Nessus	Windows	2008/11/14	2018/7/27	high
34053	Debian DSA-1632-1 : tiff - buffer underflow	Nessus	Debian Local Security Checks	2008/8/27	2021/1/4	medium
34063	RHEL 5 : libtiff (RHSA-2008:0847)	Nessus	Red Hat Local Security Checks	2008/8/30	2021/1/14	medium
67743	Oracle Linux 3 : libtiff (ELSA-2008-0863)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium

偵測

搜尋 Plugin

medium

high

high

high

critical

critical

high

high

high

high

medium

medium

medium