Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61144: libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61143: libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libtiff | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-debuginfo | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-debugsource | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-devel | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-static | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-tools | 0:4.4.0-4.amzn2023.0.25 |
| Amazon Linux · 2023 | libtiff-tools-debuginfo | 0:4.4.0-4.amzn2023.0.25 |
Vulnerabilities 2
-
Critical 9.8
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
-
Medium 5.5
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.