CVE-2024-7006

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.(CVE-2024-7006)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.(CVE-2024-7006)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.(CVE-2024-7006)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.(CVE-2024-7006)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.(CVE-2024-7006)

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-7006: check return value of _TIFFCreateAnonField()

• CVE-2024-7006: check return value of _TIFFCreateAnonField() to avoid potential DoS via memory allocation failures
• CVE-2023-6228: validate input image codec in tiffcp to prevent heap-based buffer overflow and potential application crash
• CVE-2022-40090: improve IFD loop handling in TIFFReadDirectory to prevent DoS via crafted TIFF files
• CVE-2023-2731: handle missing end-of-information marker in LZWDecode() to prevent NULL pointer dereference and potential DoS

A null pointer dereference flaw was found in Libtiff via tif_dirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service. (CVE-2024-7006)

These are all security issues fixed in the libtiff-devel-32bit-4.6.0-5.1 package on the GA media of openSUSE Tumbleweed.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

• libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for tiff fixes the following issues:

• CVE-2024-7006: Fixed null pointer dereference in tif_dirinfo.c (bsc#1228924)

This update for tiff fixes the following issues:

• CVE-2024-7006: Fixed null pointer dereference in tif_dirinfo.c (bsc#1228924)

This update for tiff fixes the following issues:

• CVE-2024-7006: Fixed null pointer dereference in tif_dirinfo.c (bsc#1228924)

This update for tiff fixes the following issues:

• CVE-2024-7006: Fix pointer deref in tif_dirinfo.c [bsc#1228924]

This update for tiff fixes the following issues:

• Update to 4.7.1: Security:
  • CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow() when processing malformed TIFF files (bsc#1247106)
  • CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)
  • CVE-2024-13978: libtiff: Fixed LibTIFF Null Pointer Dereference (bsc#1247581)
  • CVE-2025-8534: Fixed null pointer dereference in function PS_Lvl2page (bsc#1247582)
  • CVE-2025-8961: Fixed segmentation fault via main function of tiffcrop utility (bsc#1248117)
  • CVE-2025-9165: libtiff: Fixed local execution manipulation leading to memory leak (bsc#1248330)
  • CVE-2025-9900: libtiff: Fixed Write-What-Where via TIFFReadRGBAImageOriented (bsc#1250413) Software configuration changes:
  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases. Bug fixes:
  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

Software configuration changes:

• Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
• CMake: define WORDS_BIGENDIAN via tif_config.h
• doc/CMakeLists.txt: remove useless cmake_minimum_required()
• CMake: fix build with LLVM/Clang 17 (fixes issue #651)
• CMake: set CMP0074 new policy
• Set LINKER_LANGUAGE for C targets with C deps
• Export tiffxx cmake target (fixes issue #674)
• autogen.sh: Enable verbose wget.
• configure.ac: Syntax updates for Autoconf 2.71
• autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
• CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
• CMake: Add build option tiff-static (fixes issue #709)

Library changes:

• Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
• tif_predict.c: speed-up decompression in some cases.

Bug fixes:

• tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
• Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
• tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
• TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
• Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
• TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
• tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
• Fix writing a Predictor=3 file with non-native endianness
• _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
• read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
• tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
• tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
• Fix memory leak in TIFFSetupStrips() (fixes issue #665)
• tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
• Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
• tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
• tif_getimage.c: update some integer overflow checks (fixes issue #79)
• tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
• TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
• Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
• LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
• TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
• TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
• JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
• tif_jpeg: Fix bug…

It was discovered that LibTIFF incorrectly handled memory. An attacker could possibly use this issue to cause the application to crash, resulting in a denial of service.

USN-6997-1 fixed a vulnerability in LibTIFF. This update provides the corresponding update for Ubuntu 14.04 LTS.

Original advisory details:

It was discovered that LibTIFF incorrectly handled memory. An attacker could possibly use this issue to cause the application to crash, resulting in a denial of service.