Skip to content
OpenAdvisories
Low ALAS2-2025-3004 1 CVE

Low: libtiff security update (Amazon Linux 2)

Published Sep 15, 2025 · Updated Sep 29, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-9165: A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libtiff 0:4.0.3-35.amzn2.0.25
Amazon Linux · 2 libtiff-debuginfo 0:4.0.3-35.amzn2.0.25
Amazon Linux · 2 libtiff-devel 0:4.0.3-35.amzn2.0.25
Amazon Linux · 2 libtiff-static 0:4.0.3-35.amzn2.0.25
Amazon Linux · 2 libtiff-tools 0:4.0.3-35.amzn2.0.25

Vulnerabilities 1

  • Low 2.5
    CVE-2025-9165

    LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak

    A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to l…

    tiff tiff tiff qtwebengine-opensource-src Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-9165.html