Threats affecting pkg:rpm/redhat/libtiff

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A moderate severity vulnerability (CVE-2024-7006) exists in the libtiff library used for manipulating TIFF files. The issue is a NULL pointer dereference in the tif_dirinfo.c source file. This affects multiple variants of Red Hat Enterprise Linux 9 and related products. Red Hat has issued an official security advisory (RHSA-2024:8914) with an update to address this vulnerability. Users are advised to apply the update as detailed in the advisory.