According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws have been discovered in libtiff. A     remote attacker could exploit these flaws to cause a     crash or memory corruption and, possibly, execute     arbitrary code by tricking an application linked     against libtiff into processing specially crafted     files. (CVE-2016-9533, CVE-2016-9534, CVE-2016-9535)

  - Multiple flaws have been discovered in various libtiff     tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By     tricking a user into processing a specially crafted     file, a remote attacker could exploit these flaws to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff tool. (CVE-2015-8870,     CVE-2016-5652, CVE-2016-9540, CVE-2016-9537,     CVE-2016-9536)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-libtiff3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The (1) putcontig8bitYCbCr21tile function in     tif_getimage.c or (2) NeXTDecode function in tif_next.c     in LibTIFF allows remote attackers to cause a denial of     service (uninitialized memory access) via a crafted     TIFF image, as demonstrated by libtiff-cvs-1.tif and     libtiff-cvs-2.tif.(CVE-2014-8127,CVE-2014-8129,CVE-2014
    -8130,CVE-2014-9655)

  - A flaw was discovered in the bmp2tiff utility. By     tricking a user into processing a specially crafted     file, a remote attacker could exploit this flaw to     cause a crash or memory corruption and, possibly,     execute arbitrary code with the privileges of the user     running the libtiff     tool.(CVE-2014-9330,CVE-2015-7554,CVE-2015-8668,CVE-201     5-8665,CVE-2015-8781,CVE-2016-3632,CVE-2016-3945,CVE-20     16-3990,CVE-2016-3991,CVE-2016-5320,CVE-2016-5652,CVE-2     015-8683)

  - tools/tiffcp.c in libtiff has an out-of-bounds write on     tiled images with odd tile width versus image width.
    Reported as MSVR 35103, aka 'cpStripToTile     heap-buffer-overflow.'(CVE-2016-9540)

  - tif_predict.h and tif_predict.c in libtiff have     assertions that can lead to assertion failures in debug     mode, or buffer overflows in release mode, when dealing     with unusual tile size like YCbCr with subsampling.
    Reported as MSVR 35105, aka 'Predictor     heap-buffer-overflow.'(CVE-2016-9535,CVE-2016-9533,CVE-     2016-9534,CVE-2016-9536,CVE-2016-9537)

  - The NeXTDecode function in tif_next.c in LibTIFF allows     remote attackers to cause a denial of service     (uninitialized memory access) via a crafted TIFF image,     as demonstrated by libtiff5.tif.(CVE-2015-1547)

  - The NeXTDecode function in tif_next.c in LibTIFF allows     remote attackers to cause a denial of service     (out-of-bounds write) via a crafted TIFF image, as     demonstrated by libtiff5.tif.(CVE-2015-8784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files.
(CVE-2016-9533 , CVE-2016-9534 , CVE-2016-9535)

Multiple flaws have been discovered in various libtiff tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2015-8870 , CVE-2016-5652 , CVE-2016-9540 , CVE-2016-9537 , CVE-2016-9536)

The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - apache
  - apache_mod_php
  - AppleGraphicsPowerManagement
  - AppleRAID
  - Audio
  - Bluetooth
  - Carbon
  - CoreGraphics
  - CoreMedia
  - CoreText
  - curl
  - EFI
  - FinderKit
  - FontParser
  - HTTPProtocol
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOATAFamily
  - IOFireWireAVC
  - IOFireWireFamily
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - LibreSSL
  - MCX Client
  - Menus
  - Multi-Touch
  - OpenSSH
  - OpenSSL
  - Printing
  - python
  - QuickTime
  - Security
  - SecurityFoundation
  - sudo
  - System Integrity Protection
  - tcpdump
  - tiffutil
  - WebKit

libtiff project reports :

Multiple flaws have been discovered in libtiff library and utilities.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
99866	EulerOS 2.0 SP2 : libtiff (EulerOS-SA-2017-1020)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	critical
99888	EulerOS 2.0 SP2 : compat-libtiff3 (EulerOS-SA-2017-1043)	Nessus	Huawei Local Security Checks	2017/5/1	2021/4/19	critical
97434	Ubuntu 14.04 LTS / 16.04 LTS : LibTIFF vulnerabilities (USN-3212-1)	Nessus	Ubuntu Local Security Checks	2017/2/28	2023/10/20	critical
97554	Amazon Linux AMI : libtiff / compat-libtiff3 (ALAS-2017-802)	Nessus	Amazon Linux Local Security Checks	2017/3/7	2018/4/18	critical
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2019/11/13	critical
99889	EulerOS 2.0 SP1 : compat-libtiff3 (EulerOS-SA-2017-1044)	Nessus	Huawei Local Security Checks	2017/5/1	2021/4/19	critical
97035	FreeBSD : tiff -- multiple vulnerabilities (fb74eacc-ec8a-11e6-bc8a-0011d823eebd)	Nessus	FreeBSD Local Security Checks	2017/2/7	2021/1/4	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical