Most recent entries from all

ALSA-2025:17675 — Important: compat-libtiff3 security update

Affected: AlmaLinux:8: compat-libtiff3

The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.

Security Fix(es):

* libtiff: Libtiff Write-What-Where (CVE-2025-9900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-13921

BELL-CVE-2025-9900

Affected: Alpaquita:25: tiff, Alpaquita:stream: tiff, BellSoft Hardened Containers:25: tiff, BellSoft Hardened Containers:stream: tiff

certfr-2025-avi-0938 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0938

EUVD-2026-331199

fkie_cve-2025-9900

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.

By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

GHSA-qc8j-wvjf-7jfj

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.

msrc_CVE-2025-9900 — Libtiff: libtiff write-what-where

msrc_CVE-2025-9900

NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten

NCSC-2026-0022

OESA-2025-2400 — libtiff security update

Affected: openEuler:20.03-LTS-SP4: libtiff

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library. Security Fix(es):

A vulnerability classified as critical has been found in LibTIFF (Image Processing Software) (unknown version).CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-9900)

openSUSE-SU-2025:15635-1 — libtiff-devel-32bit-4.7.1-2.1 on GA media

libtiff-devel-32bit-4.7.1-2.1 on GA media

RHSA-2025:17651 — Red Hat Security Advisory: compat-libtiff3 security update

libtiff: Libtiff Write-What-Where

SUSE-SU-2025:20971-1 — Security update for tiff

Security update for tiff

UBUNTU-CVE-2025-9900

Affected: Ubuntu:Pro:14.04:LTS: gdal, Ubuntu:Pro:14.04:LTS: tiff, Ubuntu:Pro:16.04:LTS: tiff, Ubuntu:Pro:16.04:LTS: gdal, Ubuntu:Pro:18.04:LTS: tiff, Ubuntu:Pro:18.04:LTS: qtwebengine-opensource-src, Ubuntu:Pro:18.04:LTS: texmaker, Ubuntu:Pro:20.04:LTS: tiff, Ubuntu:Pro:20.04:LTS: qtwebengine-opensource-src, Ubuntu:Pro:20.04:LTS: texmaker and 11 more

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

WID-SEC-W-2025-2110 — LibTiff: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LibTiff ausnutzen, um einen Code auszuführen.