Skip to content
OpenAdvisories
High RHSA-2025:21407 3 CVEs

Red Hat Security Advisory: libtiff security update

Published Nov 17, 2025 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 libtiff 0:4.0.3-35.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7 libtiff-static 0:4.0.3-35.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7 libtiff-tools 0:4.0.3-35.el7_9.1

Vulnerabilities 3

  • High 8.8
    CVE-2025-9900

    Libtiff: libtiff write-what-where

    A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2025-8176

    LibTIFF tiffmedian.c get_histogram use after free

    A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The …

    tiff tiff libtiff tiff Debian Ubuntu Azure Linux Wolfi
  • Medium 5.3
    CVE-2025-8177

    LibTIFF thumbnail.c setrow buffer overflow

    A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6…

    tiff tiff libtiff tiff Debian Ubuntu Azure Linux Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383598
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383608
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2392784
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21407.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-8176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-8176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-8176
  • article
    http://www.libtiff.org/
  • article
    https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172
  • article
    https://gitlab.com/libtiff/libtiff/-/issues/707
  • article
    https://gitlab.com/libtiff/libtiff/-/merge_requests/727
  • article
    https://vuldb.com/?ctiid.317590
  • article
    https://vuldb.com/?id.317590
  • article
    https://vuldb.com/?submit.621796
  • report
    https://access.redhat.com/security/cve/CVE-2025-8177
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-8177
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-8177
  • article
    https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22
  • article
    https://gitlab.com/libtiff/libtiff/-/issues/715
  • article
    https://gitlab.com/libtiff/libtiff/-/merge_requests/737
  • article
    https://vuldb.com/?ctiid.317591
  • article
    https://vuldb.com/?id.317591
  • article
    https://vuldb.com/?submit.621797
  • report
    https://access.redhat.com/security/cve/CVE-2025-9900
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-9900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-9900
  • article
    https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file
  • article
    https://gitlab.com/libtiff/libtiff/-/issues/704
  • article
    https://gitlab.com/libtiff/libtiff/-/merge_requests/732
  • article
    https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html