CVE-2024-7006

High

Advisory

Published 12 Aug 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.015; 73rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 204; of 17,781 indexed, latest versions
Container images: 212; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: libtiff security update

Carried by container images the latest versions of 204 of 17,781 indexed charts deploy, on 212 images.

Affected package	Affected versions	Fixed in	Images
tiffdeb	4.0.3-7ubuntu0.9, 4.0.6-1ubuntu0.2, 4.0.6-1ubuntu0.4, 4.0.6-1ubuntu0.5+28 more	4.0.3-7ubuntu0.11+esm14, 4.0.6-1ubuntu0.8+esm17, 4.0.9-5ubuntu0.10+esm7, 4.1.0+git191117-2ubuntu0.20.04.14+3 more	195
libtiffrpm	4.0.9-17.el8, 4.0.9-18.el8, 4.0.9-28.el8_8, 4.0.9-29.el8_8+2 more	0:4.0.9-33.el8_10, 0:4.4.0-12.el9_4.1	17

OSV records: DEBIAN-CVE-2024-7006 RHSA-2024:8833 RHSA-2024:8914 UBUNTU-CVE-2024-7006
Also known as: USN-6997-1, USN-6997-2

Charts affected

204 by stars

Chart

Latest

Affected images

Radar Score

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2024-7006.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	tiff@4.5.0-6	4.5.0-6+deb12u2

Open the chart page →

14,358

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2024-7006.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	tiff@4.3.0-6ubuntu0.7	4.3.0-6ubuntu0.10

Open the chart page →

13,459

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2024-7006.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	tiff@4.3.0-6ubuntu0.9	4.3.0-6ubuntu0.10

Open the chart page →

14,100

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2024-7006.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u2

Open the chart page →

7,673

Container images carrying it

212 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	tiff@4.5.0-6	4.5.0-6+deb12u2	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u2	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	tiff@4.1.0+git191117-2ubuntu0.20.04.3	4.1.0+git191117-2ubuntu0.20.04.14	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u2	1
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	libtiff@4.4.0-12.el9	0:4.4.0-12.el9_4.1	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	libtiff@4.0.9-28.el8_8	0:4.0.9-33.el8_10	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	libtiff@4.0.9-18.el8	0:4.0.9-33.el8_10	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	libtiff@4.0.9-17.el8	0:4.0.9-33.el8_10	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	tiff@4.0.6-1ubuntu0.6	4.0.6-1ubuntu0.8+esm17	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	libtiff@4.4.0-12.el9	0:4.4.0-12.el9_4.1	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	libtiff@4.0.9-18.el8	0:4.0.9-33.el8_10	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	tiff@4.5.0-6	4.5.0-6+deb12u2	1