Описание
Security update for tiff
This update for tiff fixes the following issues
Security issues:
- CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow (bsc#1248278).
- CVE-2026-4775: signed integer overflow in the
putcontig8bitYCbCr44tilefunction (bsc#1260411).
Non security issue:
- QGIS can't export with GDAL- LERC codec, LERC library not found anywhere in the system (bsc#1257123).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1248278
- SUSE Bug 1257123
- SUSE Bug 1260411
- SUSE CVE CVE-2018-7456 page
- SUSE CVE CVE-2023-0800 page
- SUSE CVE CVE-2023-0801 page
- SUSE CVE CVE-2023-0802 page
- SUSE CVE CVE-2023-0803 page
- SUSE CVE CVE-2023-0804 page
- SUSE CVE CVE-2025-8851 page
- SUSE CVE CVE-2026-4775 page
Описание
A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
Затронутые продукты
Ссылки
- CVE-2018-7456
- SUSE Bug 1074317
- SUSE Bug 1082825
Описание
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Затронутые продукты
Ссылки
- CVE-2023-0800
- SUSE Bug 1208231
Описание
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Затронутые продукты
Ссылки
- CVE-2023-0801
- SUSE Bug 1208232
Описание
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Затронутые продукты
Ссылки
- CVE-2023-0802
- SUSE Bug 1208233
Описание
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Затронутые продукты
Ссылки
- CVE-2023-0803
- SUSE Bug 1208234
Описание
LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
Затронутые продукты
Ссылки
- CVE-2023-0804
- SUSE Bug 1208236
Описание
A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
Затронутые продукты
Ссылки
- CVE-2025-8851
- SUSE Bug 1248274
Описание
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
Затронутые продукты
Ссылки
- CVE-2026-4775
- SUSE Bug 1260411