CVE-2024-7006

CWE-476 — NULL Pointer DereferenceCWE-75410 documents9 sources
Severity
7.5HIGH
EPSS
0.5%
top 32.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Libtiff LibtiffRedhat Enterprise LinuxRedhat Enterprise Linux FOR ARM 64+2 more
Timeline
PublishedAug 12
Latest updateOct 29

Description

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDlibtiff/libtiff3.5.1 — 4.6.0
▶Debiantiff< 4.2.0-1+deb11u6+3

Also affects: Enterprise Linux 8.0, 9.0, 9.2

🔴Vulnerability Details

3
OSV
CVE-2024-7006: A null pointer dereference flaw was found in Libtiff via `tif_dirinfo↗2024-08-12
▶
GHSA
GHSA-r7x8-hv2q-v9r7: A null pointer dereference flaw was found in Libtiff via `tif_dirinfo↗2024-08-12
▶
CVEList
Libtiff: null pointer dereference in tif_dirinfo.c↗2024-08-08
▶

📋Vendor Advisories

6
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2024-7006↗2024-10-29
▶
Ubuntu
LibTIFF vulnerability↗2024-09-11
▶
Ubuntu
LibTIFF vulnerability↗2024-09-09
▶
Microsoft
Libtiff: null pointer dereference in tif_dirinfo.c↗2024-08-13
▶
Red Hat
libtiff: NULL pointer dereference in tif_dirinfo.c↗2024-07-19
▶