Skip to content
OpenAdvisories
Critical RHSA-2017:0225 8 CVEs

Red Hat Security Advisory: libtiff security update

Published Sep 15, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client libtiff 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client libtiff-debuginfo 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client libtiff-devel 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::client libtiff-static 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode libtiff 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode libtiff-debuginfo 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode libtiff-devel 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::computenode libtiff-static 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server libtiff 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server libtiff-debuginfo 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server libtiff-devel 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::server libtiff-static 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation libtiff 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation libtiff-debuginfo 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation libtiff-devel 0:3.9.4-21.el6_8
Red Hat · RHEL 6 enterprise_linux:6::workstation libtiff-static 0:3.9.4-21.el6_8
Red Hat · RHEL 7 enterprise_linux:7::client libtiff 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client libtiff-debuginfo 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client libtiff-devel 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client libtiff-static 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client libtiff-tools 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode libtiff 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode libtiff-debuginfo 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode libtiff-devel 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode libtiff-static 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode libtiff-tools 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server libtiff 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server libtiff-debuginfo 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server libtiff-devel 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server libtiff-static 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server libtiff-tools 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation libtiff 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation libtiff-debuginfo 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation libtiff-devel 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation libtiff-static 0:4.0.3-27.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation libtiff-tools 0:4.0.3-27.el7_3

Vulnerabilities 8

  • Critical 9.8
    CVE-2016-9535

    tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or …

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2015-8870

    Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap…

    tiff Debian
  • Unscored —
    CVE-2016-5652

    An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted T…

    LibTIFF LibTIFF tiff tiff Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9533

    tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 350…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9534

    tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc an…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9536

    tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9537

    tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 3509…

    tiff tiff Debian Ubuntu
  • Unscored —
    CVE-2016-9540

    tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Repo…

    tiff tiff Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1389222
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397751
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397755
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397758
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397760
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397769
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1402778
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0225.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-8870
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-8870
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-8870
  • report
    https://access.redhat.com/security/cve/CVE-2016-5652
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5652
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5652
  • article
    http://www.talosintelligence.com/reports/TALOS-2016-0187/
  • report
    https://access.redhat.com/security/cve/CVE-2016-9533
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9533
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9533
  • report
    https://access.redhat.com/security/cve/CVE-2016-9534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9534
  • report
    https://access.redhat.com/security/cve/CVE-2016-9535
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9535
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9535
  • report
    https://access.redhat.com/security/cve/CVE-2016-9536
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9536
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9536
  • report
    https://access.redhat.com/security/cve/CVE-2016-9537
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9537
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9537
  • report
    https://access.redhat.com/security/cve/CVE-2016-9540
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9540
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9540