CVE-2024-13978: libtiff Improper Resource Shutdown or Release
Vulnerability summary
CVE-2024-13978 is a low (CVSS 2.5) Improper Resource Shutdown or Release vulnerability in libtiff. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 01-08-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.
CVSS metrics
12 scores · 6 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
- NVDNIST2.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
- OSV · UbuntuEcosystem advisory · calculated2.5LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST2.5LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST1.0LowAV:L/AC:H/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
+0.01 pp
From 0.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu5 products
- gdalAll versions (No fix recorded)
- neuronAll versions (No fix recorded)
- qtwebengine-opensource-srcAll versions (No fix recorded)
- texmakerAll versions (No fix recorded)
- tiff< 4.7.0-3ubuntu2
Chainguard1 product
- tiff< 4.7.0-r6
Debian1 product
- tiffAll versions (No fix recorded) | < 4.7.0-3+deb13u1 | < 4.7.0-4
Libtiff1 product
- libtiff≤ 4.7.0
Wolfi1 product
- tiff< 4.7.0-r6
5 vendors · 9 products
