CVE catalog
CVE-2024-13978
tiff: CVE-2024-13978
- Severity
- Medium · CVSS 4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.21% · Oct 25, 2026
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | tiff | sid | 4.7.2-1 | fixed |
| Debian | tiff | forky | 4.7.2-1 | fixed |
| Debian | tiff | trixie | 4.7.0-3+deb13u3 | fixed |
| Debian | tiff | trixie-security | 4.7.0-3+deb13u3 | fixed |
| Debian | tiff | bookworm | 4.5.0-6+deb12u4 | vulnerable |
| Debian | tiff | bookworm-security | 4.5.0-6+deb12u4 | vulnerable |
| Opensuse | tiff | leap 16.0 | 4.7.1-160000.1.1 | fixed |
| Opensuse | tiff-man | leap 16.0 | 4.7.1-160000.1.1 | fixed |
| Opensuse | tiff | tumbleweed | 4.7.0-8.1 | fixed |
| Suse | tiff | linux enterprise server 16.0 | 4.7.1-160000.1.1 | fixed |
| Suse | tiff | linux enterprise server for sap applications 16.0 | 4.7.1-160000.1.1 | fixed |
| Suse | tiff | linux enterprise module for basesystem 15 sp6 | 4.7.0-150600.3.18.1 | fixed |
| Suse | tiff | linux enterprise module for basesystem 15 sp7 | 4.7.0-150600.3.18.1 | fixed |
| Suse | tiff | linux enterprise module for package hub 15 sp6 | 4.7.0-150600.3.18.1 | fixed |
| Suse | tiff | linux enterprise module for package hub 15 sp7 | 4.7.0-150600.3.18.1 | fixed |
| Opensuse | tiff | leap 15.6 | 4.7.0-150600.3.18.1 | fixed |
| Suse | tiff | linux micro 6.2 | 4.7.1-160000.1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | tiff | source | sid | 4.7.0-4 | not yet assigned | Not reported | [1111323] |
| Debian | tiff | source | forky | 4.7.0-4 | not yet assigned | Not reported | [1111323] |
| Debian | tiff | source | trixie | 4.7.0-3+deb13u1 | not yet assigned | Not reported | [1111323] |
| Debian | tiff | source | bookworm | (unfixed) | not yet assigned | Not reported | [1111323] |
| Opensuse | tiff | rpm | leap 16.0 | 4.7.1-160000.1.1 | Not reported | OPENSUSE-SU-2025:20049-1 | Not reported |
| Opensuse | tiff-man | rpm | leap 16.0 | 4.7.1-160000.1.1 | Not reported | OPENSUSE-SU-2025:20049-1 | Not reported |
| Opensuse | tiff | rpm | tumbleweed | 4.7.0-8.1 | Not reported | OPENSUSE-SU-2025:15486-1 | Not reported |
| Suse | tiff | rpm | linux enterprise server 16.0 | 4.7.1-160000.1.1 | Not reported | SUSE-SU-2025:21009-1 | Not reported |
| Suse | tiff | rpm | linux enterprise server for sap applications 16.0 | 4.7.1-160000.1.1 | Not reported | SUSE-SU-2025:21009-1 | Not reported |
| Suse | tiff | rpm | linux enterprise module for basesystem 15 sp6 | 4.7.0-150600.3.18.1 | Not reported | SUSE-SU-2025:03348-1 | Not reported |
| Suse | tiff | rpm | linux enterprise module for basesystem 15 sp7 | 4.7.0-150600.3.18.1 | Not reported | SUSE-SU-2025:03348-1 | Not reported |
| Suse | tiff | rpm | linux enterprise module for package hub 15 sp6 | 4.7.0-150600.3.18.1 | Not reported | SUSE-SU-2025:03348-1 | Not reported |
| Suse | tiff | rpm | linux enterprise module for package hub 15 sp7 | 4.7.0-150600.3.18.1 | Not reported | SUSE-SU-2025:03348-1 | Not reported |
| Opensuse | tiff | rpm | leap 15.6 | 4.7.0-150600.3.18.1 | Not reported | SUSE-SU-2025:03348-1 | Not reported |
| Suse | tiff | rpm | linux micro 6.2 | 4.7.1-160000.1.1 | Not reported | SUSE-SU-2025:21032-1 | Not reported |
Notes
[bookworm] tiff: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libtiff5-dev]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiff6]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiff-dev]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiff-doc]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· all · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· all · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· all · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· all · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiff-opengl]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiff-tools]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
- [libtiffxx6]Unknown
Source package: [tiff]
Details (4)
4.5.0-6+deb12u4· amd64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookwormAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· amd64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
4.5.0-6+deb12u4· arm64 · bookworm-securityAffected
dsa · tiff · debian · bookworm; dsa · tiff · debian · 12
[Debian 13 (Trixie)]
- [libtiff5-dev]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiff6]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiff-dev]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiff-doc]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· all · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· all · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· all · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· all · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiff-opengl]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiff-tools]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
- [libtiffxx6]Unknown
Source package: [tiff]
Details (4)
4.7.0-3+deb13u2· amd64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u2· arm64 · trixieFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· amd64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
4.7.0-3+deb13u3· arm64 · trixie-securityFixed · Fixed:
4.7.0-3+deb13u1dsa · tiff · debian · 13
[openSUSE Tumbleweed]
- [libtiff6]Unknown
Source package: [tiff]
Details (1)
4.7.2-1.2· x86_64 · tumbleweedUnknown · Fixed:
4.7.0-8.1Version impact unknown
dsa · tiff · opensuse · tumbleweed
- [libtiff6-32bit]Unknown
Source package: [tiff]
Details (1)
4.7.2-1.2· x86_64 · tumbleweedUnknown · Fixed:
4.7.0-8.1Version impact unknown
dsa · tiff · opensuse · tumbleweed
- [libtiff-devel]Unknown
Source package: [tiff]
Details (1)
4.7.2-1.2· x86_64 · tumbleweedUnknown · Fixed:
4.7.0-8.1Version impact unknown
dsa · tiff · opensuse · tumbleweed
- [libtiff-devel-32bit]Unknown
Source package: [tiff]
Details (1)
4.7.2-1.2· x86_64 · tumbleweedUnknown · Fixed:
4.7.0-8.1Version impact unknown
dsa · tiff · opensuse · tumbleweed
- [tiff]Unknown
Source package: [tiff]
Details (1)
4.7.2-1.2· x86_64 · tumbleweedFixed · Fixed:
4.7.0-8.1dsa · tiff · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03348-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-13978]
- [https://osv.dev/vulnerability/DLA-4315-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:03348-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:21009-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:21032-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15486-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:20049-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-13978]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-13978.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1730.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]