What’s Vulnerable › Vulnerabilities
CVE-2024-7006: Libtiff: null pointer dereference in tif_dirinfo.c
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-12 · updated 2026-06-17
- Weakness: CWE-476
Description
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.
Affected products
- libtiff: from 3.5.1 through 4.6.0
- Red Hat Enterprise Linux: 8.0, 9.0
- RedHat Enterprise Linux For Arm 64: 9.2
- RedHat Enterprise Linux For Power Little Endian Eus: 9.2
- RedHat Enterprise Linux Server Aus: 9.2
References
- https://access.redhat.com/errata/RHSA-2024:6360
- https://access.redhat.com/errata/RHSA-2024:8833
- https://access.redhat.com/errata/RHSA-2024:8914
- https://access.redhat.com/security/cve/CVE-2024-7006
- https://bugzilla.redhat.com/show_bug.cgi?id=2302996
- https://lists.debian.org/debian-lts-announce/2025/01/msg00019.html
- https://security.netapp.com/advisory/ntap-20240920-0001/
Get alerted when CVE-2024-7006 or the next vulnerability affects your stack