An update of the libtiff package has been released.

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users,     during install/upgrade workflow, to replace one of the Agent's executables before it can be executed. This     allows the user to elevate their permissions. (CVE-2023-0975)

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of     service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers     a heap-based buffer overflow. (CVE-2023-40745)

  - A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw     allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted     tiff image, which triggers a heap-based buffer overflow. (CVE-2023-41175)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - libtiff にメモリ不足の欠陥が見つかりました。これは、細工された tiff ファイルを TIFFRasterScanlineSize64() API に渡すことで発生する可能性があります。この欠陥により、リモートの攻撃者は 379 KB より小さいサイズの細工された入力を介してサービス拒否を引き起こすことができます。CVE-2023-52355

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote NewStart CGSL host, running version MAIN 7.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to     the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading     to a denial of service. (CVE-2023-52356)

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 libtiff 中发现一个内存不足缺陷可通过将构建的 tiff 文件传递至 TIFFRasterScanlineSize64() API 来触发。此缺陷允许远程攻击者通过构建的小于 379 KB 的输入造成拒绝服务。 (CVE-2023-52355)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 libtiff 中發現一個記憶體不足瑕疵傳送特製 tiff 檔案至 TIFFRasterScanlineSize64() API 時可觸發該瑕疵。此瑕疵可讓遠端攻擊者透過大小小於 379 KB 的特製輸入造成拒絕服務。 (CVE-2023-52355)

請注意，Nessus 依賴供應商報告的套件存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the     TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a     crafted input with a size smaller than 379 KB. (CVE-2023-52355)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
204333	Photon OS 4.0: Libtiff PHSA-2024-4.0-0558	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
242726	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0128)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
227328	Linux Distros のパッチ未適用の脆弱性: CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/9/10	high
237995	NewStart CGSL MAIN 7.02 : libtiff Multiple Vulnerabilities (NS-SA-2025-0070)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	high
203881	Photon OS 3.0: Libtiff PHSA-2024-3.0-0719	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
204151	Photon OS 5.0: Libtiff PHSA-2024-5.0-0196	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
227328	Linux Distros 未修补的漏洞：CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/9/10	high
227328	Linux Distros 未修補的弱點：CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/9/10	high
227328	Linux Distros Unpatched Vulnerability : CVE-2023-52355	Nessus	Misc.	2025/3/5	2025/9/10	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high