Skip to content
OpenAdvisories
Medium ALAS2023-2025-1212 4 CVEs

Moderate: libtiff security update (Amazon Linux 2023)

Published Oct 14, 2025 · Updated Mar 5, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8961: A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. CVE-2025-61145: libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c. CVE-2023-3164: A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file. CVE-2023-1916: A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libtiff 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-debuginfo 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-debugsource 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-devel 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-static 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-tools 0:4.4.0-4.amzn2023.0.23
Amazon Linux · 2023 libtiff-tools-debuginfo 0:4.4.0-4.amzn2023.0.23

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-1916.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-3164.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-61145.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-8961.html