Skip to content
OpenAdvisories
Low ALAS2023-2025-1176 1 CVE

Low: libtiff security update (Amazon Linux 2023)

Published Sep 10, 2025 · Updated Sep 15, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-9165: A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libtiff 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-debuginfo 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-debugsource 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-devel 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-static 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-tools 0:4.4.0-4.amzn2023.0.22
Amazon Linux · 2023 libtiff-tools-debuginfo 0:4.4.0-4.amzn2023.0.22

Vulnerabilities 1

  • Low 2.5
    CVE-2025-9165

    LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak

    A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to l…

    tiff tiff tiff qtwebengine-opensource-src Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-9165.html