Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61144: libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61143: libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | compat-libtiff3 | 0:3.9.4-12.amzn2.0.8 |
| Amazon Linux · 2 | compat-libtiff3-debuginfo | 0:3.9.4-12.amzn2.0.8 |
Vulnerabilities 2
-
Critical 9.8
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
-
Medium 5.5
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.