Summary
Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled
memory when parsing malformed TIFF images. An attacker could possibly use
this issue to cause LibTIFF to crash, resulting in a denial of service.
(CVE-2025-8961)
Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled
memory when parsing malformed TIFF image headers. An attacker could
possibly use this issue to cause LibTIFF to leak memory, resulting in a
denial of service. (CVE-2025-9165)
It was discovered that LibTIFF incorrectly handled memory when parsing
malformed TIFF image metadata. An attacker could possibly use this issue to
cause a denial of service, obtain sensitive information, or execute
arbitrary code. (CVE-2025-9900)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | tiff | 4.3.0-6ubuntu0.12 |
| Ubuntu · 24.04 LTS 24.04:LTS | tiff | 4.5.1+git230720-4ubuntu2.4 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | tiff | 4.0.3-7ubuntu0.11+esm16 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | tiff | 4.0.6-1ubuntu0.8+esm19 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | tiff | 4.0.9-5ubuntu0.10+esm9 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | tiff | 4.1.0+git191117-2ubuntu0.20.04.14+esm2 |
Vulnerabilities 3
-
High 8.8
Libtiff: libtiff write-what-where
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the …
-
Low 3.3
LibTIFF tiffcrop tiffcrop.c main memory corruption
A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made availabl…
-
Low 2.5
LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak
A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to l…