Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61144: libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61143: libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libtiff | 0:4.0.3-35.amzn2.0.29 |
| Amazon Linux · 2 | libtiff-debuginfo | 0:4.0.3-35.amzn2.0.29 |
| Amazon Linux · 2 | libtiff-devel | 0:4.0.3-35.amzn2.0.29 |
| Amazon Linux · 2 | libtiff-static | 0:4.0.3-35.amzn2.0.29 |
| Amazon Linux · 2 | libtiff-tools | 0:4.0.3-35.amzn2.0.29 |
Vulnerabilities 2
-
Critical 9.8
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
-
Medium 5.5
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.