Description
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | LibTIFF | 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tiff | 4.7.0-4 | — |
| Debian 13 | tiff | 4.7.0-3+deb13u1 | — |
| Debian 12 | tiff | No fix yet | — |
| Debian 11 | tiff | 4.2.0-1+deb11u7 | DLA-4315-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | texmaker +1 | No fix yet | — |
| Ubuntu 26.04 LTS | texmaker | No fix yet | — |
| Ubuntu 25.10 | texmaker +1 | No fix yet | — |
| Ubuntu 25.10 | tiff | 4.7.0-3ubuntu2 | — |
| Ubuntu 22.04 LTS | neuron | No fix yet | — |
| Ubuntu 20.04 LTS | neuron | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | neuron | No fix yet | — |
| Ubuntu 16.04 LTS | texmaker | No fix yet | — |
| Ubuntu Pro 26.04 LTS | qtwebengine-opensource-src | No fix yet | — |
| Ubuntu Pro 24.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gdal | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gdal | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tiff | 4.7.0-150600.3.18.1 | SUSE-SU-2025:03348-1 |
| SLES 15 SP6 | tiff | 4.7.0-150600.3.18.1 | SUSE-SU-2025:03348-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21009-1 |
| SLES 16.0 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21009-1 |
| SLE Micro 6.2 | tiff | 4.7.1-160000.1.1 | SUSE-SU-2025:21032-1 |
| SLE Micro 6.1 | tiff | 4.7.1-slfo.1.1_1.1 | SUSE-SU-2025:20971-1 |
| SLE Micro 6.0 | tiff | 4.7.1-1.1 | SUSE-SU-2025:21037-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tiff | 4.7.0-8.1 | openSUSE-SU-2025:15486-1 |
| openSUSE Leap 16.0 | tiff +1 | 4.7.1-160000.1.1 | openSUSE-SU-2025:20049-1 |
| openSUSE Leap 15.6 | tiff | 4.7.0-150600.3.18.1 | SUSE-SU-2025:03348-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtiff | 4.6.0-10 | — |
| Azure Linux 2 (CBL-Mariner) | libtiff | 4.6.0-9 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | tiff | 4.7.0-r6 | — |
Advisories 10
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- openSUSE-SU-2025:20049-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15486-1 libtiff-devel-32bit-4.7.0-8.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21009-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20971-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21037-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03348-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21032-1 Security update for tiff SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1700 libTIFF: Schwachstelle ermöglicht einen Denial of Service BSI CERT-Bund (WID) · Nov 27, 2025
- DLA-4315-1 tiff - security update Debian Security (DSA / DLA) · Sep 30, 2025
References
- VDB-318355 | LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference vdb-entry technical-description
- VDB-318355 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #624562 | LibTIFF v4.7.0 NULL Pointer Dereference third-party-advisory
- https://gitlab.com/libtiff/libtiff/-/issues/649 issue-tracking
- https://gitlab.com/libtiff/libtiff/-/merge_requests/667 patch
- https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4 patch
- http://www.libtiff.org/ product