CVE-2024-13978

Katalog CVE

CVSS 2.5 · Low EPSS 0,20%

Kerentanan Improper Resource Shutdown or Release pada libtiff. Skor CVSS 3.1 2.5 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

1 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.5 (Low), sumber vuldb.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release
CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 8,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/libtiff/libtiff/-/issues/649 exploit · issue tracking · advisory vendor
• https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4 patch
• https://vuldb.com/?id.318355 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.624562 advisory pihak ketiga · vdb entry
• http://www.libtiff.org/ product
• https://gitlab.com/libtiff/libtiff/-/merge_requests/667 product
• https://vuldb.com/?ctiid.318355 permissions required · vdb entry
• https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html