Log in Start free

Vulnerability · Published Aug 8, 2024 · Assigned by redhat

CVE-2024-7006Libtiff: null pointer dereference in tif_dirinfo.c

High 7.5

In plain English

A high-severity null pointer dereference in libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 25.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libtiff4.0.9-33.el8_10ALSA-2024:8833
AlmaLinux:9libtiff4.4.0-12.el9_4.1ALSA-2024:8914
AlmaLinux:8libtiff-devel4.0.9-33.el8_10ALSA-2024:8833
AlmaLinux:9libtiff-devel4.4.0-12.el9_4.1ALSA-2024:8914
AlmaLinux:8libtiff-tools4.0.9-33.el8_10ALSA-2024:8833
AlmaLinux:9libtiff-tools4.4.0-12.el9_4.1ALSA-2024:8914
Debian:12tiff4.5.0-6+deb12u2DEBIAN-CVE-2024-7006
Debian:13tiff4.5.1+git230720-5DEBIAN-CVE-2024-7006
Debian:14tiff4.5.1+git230720-5DEBIAN-CVE-2024-7006
Rocky Linux:8libtiff0:4.0.9-33.el8_10RLSA-2024:8833
Rocky Linux:9libtiff0:4.4.0-12.el9_4.1RLSA-2024:8914
Ubuntu:22.04:LTSneuronno fix listedUBUNTU-CVE-2024-7006
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2024-7006
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2024-7006
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2024-7006
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2024-7006
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2024-7006
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.10USN-6997-1
Ubuntu:22.04:LTStiff4.3.0-6ubuntu0.10UBUNTU-CVE-2024-7006
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.2UBUNTU-CVE-2024-7006
Ubuntu:24.04:LTStiff4.5.1+git230720-4ubuntu2.2USN-6997-1
Ubuntu:25.10tiff4.5.1+git230720-4ubuntu4UBUNTU-CVE-2024-7006

Affected products (as reported)

VendorProductVersions
libtiff see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References