The libtiff library in Red Hat Enterprise Linux 7 Extended Lifecycle Support contains three security vulnerabilities: a use-after-free (CVE-2025-8176), a buffer overflow (CVE-2025-8177), and a write-what-where vulnerability (CVE-2025-9900). These flaws could potentially be exploited to cause memory corruption or arbitrary code execution. Red Hat Product Security has released updated libtiff packages to fix these issues, as detailed in advisory RHSA-2025:21407. The advisory covers multiple architectures including x86_64, s390x, ppc64, and ppc64le. No CVSS scores are provided in the advisory, but the impact is rated as important/high. No known exploits in the wild have been reported at this time.

The vulnerabilities in libtiff could allow an attacker to exploit memory corruption issues such as use-after-free, buffer overflow, and write-what-where conditions. This may lead to denial of service or potentially arbitrary code execution depending on the context in which libtiff is used. The advisory rates the security impact as important, indicating a high severity level for affected systems running Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat has released updated libtiff packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:21407. Detailed instructions and updated packages are available from Red Hat's official errata page. No additional mitigation steps are indicated beyond applying the official update.