Log in Start free

Vulnerability · Published Aug 1, 2025 · Assigned by VulDB

CVE-2024-13978LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference

Low 2.5

In plain English

A low-severity null pointer dereference in LibTIFF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.2%top 86.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tiffno fix listedDEBIAN-CVE-2024-13978
Debian:13tiff4.7.0-3+deb13u1DEBIAN-CVE-2024-13978
Debian:14tiff4.7.0-4DEBIAN-CVE-2024-13978
Ubuntu:22.04:LTSneuronno fix listedUBUNTU-CVE-2024-13978
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2024-13978
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2024-13978
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2024-13978
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2024-13978
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2024-13978
Ubuntu:25.10tiff4.7.0-3ubuntu2UBUNTU-CVE-2024-13978

Affected products (as reported)

VendorProductVersions
n/a LibTIFF 4.04.14.24.34.44.54.64.7.0

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References