A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

ELSA-2025-20034-0: libtiff security update (IMPORTANT)

Уязвимость функции get_histogram библиотеки LibTIFF, позволяющая нарушителю выполнить произвольный код

Security update for tiff

Security update for tiff

Important: libtiff security update

Important: compat-libtiff3 security update

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

ELSA-2025-20998: libtiff security update (IMPORTANT)

ELSA-2025-19276: libtiff security update (IMPORTANT)

ELSA-2025-19156: libtiff security update (IMPORTANT)

ELSA-2025-17710: compat-libtiff3 security update (IMPORTANT)

ELSA-2025-17675: compat-libtiff3 security update (IMPORTANT)

Уязвимость библиотеки LibTIFF, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код на целевой системе

Security update for tiff

Security update for tiff

Security update for tiff

Security update for tiff

ALT-PU-2025-13034: package `libtiff` update to version 4.4.0-alt9

ALT-PU-2025-12867: package `libtiff5` update to version 4.4.0-alt9