Every CVE Search/ Get API key

CVE-2024-13978

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference

2.0 LowFix available

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.23%Up 0.2 points since Aug 2, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.0

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
CVE-2024-13978
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CVSS 3.0
2.5 LowCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CVSS 2.0
1.0 AV:L/AC:H/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C
Weakness
CWE-476, CWE-404
Updated
2026-11-02
EUVDEUVD-2024-54843 2.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
EUVD-2024-54843
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Updated
2026-11-02
GitHub AdvisoriesGHSA-p48p-6mxj-w7jx 2.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected...

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
GHSA-p48p-6mxj-w7jx
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
NVD 2.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
CVE-2024-13978
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.0 LowAV:L/AC:H/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSVBELL-CVE-2024-13978 2.5
Record
BELL-CVE-2024-13978
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 2.0

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
CVE-2024-13978
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Weakness
CWE-404, CWE-476
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2024-13978 2.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
DEBIAN-CVE-2024-13978
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVJLSEC-2025-319 2.0

A vulnerability was found in LibTIFF up to 4.7.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
JLSEC-2025-319
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 2.0
1.0 LowAV:L/AC:H/Au:S/C:N/I:N/A:P
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1978 2.5

libtiff security update

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.(CVE-2024-13978)

Record
OESA-2025-1978
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-13978 2.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
UBUNTU-CVE-2024-13978
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-67256 No score

CVE-2024-13978 affecting package libtiff for versions less than 4.6.0-10

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
AZL-67256
Updated
2026-11-05
OSVAZL-67259 No score

CVE-2024-13978 affecting package libtiff for versions less than 4.6.0-9

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

Record
AZL-67259
Updated
2026-11-02
OSVCLSA-2026-1785455561 No score

libtiff: Fix of 2 CVEs

  • CVE-2024-13978: reject zero tile width/length in t2p_read_tiff_init
  • CVE-2025-9165: close the first file when tiffcmp cannot open the second
Record
CLSA-2026-1785455561
Updated
2026-11-02
OSVCLSA-2026-1787398056 No score

libtiff: Fix of 2 CVEs

  • CVE-2024-13978: NULL pointer dereference in tiff2pdf t2p_read_tiff_init() on a tiled TIFF declaring a zero tile width or length
  • CVE-2025-9165: memory leak in tiffcmp when the second input file cannot be opened
Record
CLSA-2026-1787398056
Updated
2026-11-02
OSVMGASA-2025-0252 No score

Updated libtiff packages fix security vulnerabilities

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference. (CVE-2024-13978) LibTIFF tiffmedian.c get_histogram use after free. (CVE-2025-8176) LibTIFF thumbnail.c setrow buffer overflow. (CVE-2025-8177) libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference. (CVE-2025-8534) LibTIFF tiffcrop tiffcrop.c main memory corruption. (CVE-2025-8961) LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak. (CVE-2025-9165) Libtiff: libtiff write-what-where. (CVE-2025-9900)

Record
MGASA-2025-0252
Updated
2026-11-02
OSVopenSUSE-SU-2025:15486-1 No score

libtiff-devel-32bit-4.7.0-8.1 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.7.0-8.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15486-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20049-1 No score

Security update for tiff

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

  • Software configuration changes:

    • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
    • CMake: define WORDS_BIGENDIAN via tif_config.h
    • doc/CMakeLists.txt: remove useless cmake_minimum_required()
    • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
    • CMake: set CMP0074 new policy
    • Set LINKER_LANGUAGE for C targets with C deps
    • Export tiffxx cmake target (fixes issue #674)
    • autogen.sh: Enable verbose wget.
    • configure.ac: Syntax updates for Autoconf 2.71
    • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
    • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
    • CMake: Add build option tiff-static (fixes issue #709) Library changes:
    • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
    • tif_predict.c: speed-up decompression in some cases.

  • Bug fixes:

    • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
    • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
    • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
    • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
    • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
    • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
    • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
    • Fix writing a Predictor=3 file with non-native endianness
    • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
    • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
    • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
    • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
    • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
    • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
    • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
    • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
    • tif_getimage.c: update some integer overflow checks (fixes issue #79)
    • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
    • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
    • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
    • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
    • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
    • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
    • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
    • tif_jpeg: Fix bug in…
Record
openSUSE-SU-2025:20049-1
Updated
2026-11-02
OSVSUSE-SU-2025:03348-1 No score

Security update for tiff

This update for tiff fixes the following issues:

  • CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
  • CVE-2024-13978: null pointer dereference in component fax2ps (bsc#1247581)
  • CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
  • CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).
Record
SUSE-SU-2025:03348-1
Updated
2026-11-02
OSVSUSE-SU-2025:20971-1 No score

Security update for tiff

This update for tiff fixes the following issues:

  • Update to 4.7.1: Security:
    • CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow() when processing malformed TIFF files (bsc#1247106)
    • CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)
    • CVE-2024-13978: libtiff: Fixed LibTIFF Null Pointer Dereference (bsc#1247581)
    • CVE-2025-8534: Fixed null pointer dereference in function PS_Lvl2page (bsc#1247582)
    • CVE-2025-8961: Fixed segmentation fault via main function of tiffcrop utility (bsc#1248117)
    • CVE-2025-9165: libtiff: Fixed local execution manipulation leading to memory leak (bsc#1248330)
    • CVE-2025-9900: libtiff: Fixed Write-What-Where via TIFFReadRGBAImageOriented (bsc#1250413) Software configuration changes:
    • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
    • CMake: define WORDS_BIGENDIAN via tif_config.h
    • doc/CMakeLists.txt: remove useless cmake_minimum_required()
    • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
    • CMake: set CMP0074 new policy
    • Set LINKER_LANGUAGE for C targets with C deps
    • Export tiffxx cmake target (fixes issue #674)
    • autogen.sh: Enable verbose wget.
    • configure.ac: Syntax updates for Autoconf 2.71
    • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
    • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
    • CMake: Add build option tiff-static (fixes issue #709) Library changes:
    • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
    • tif_predict.c: speed-up decompression in some cases. Bug fixes:
    • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
    • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
    • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
    • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
    • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
    • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
    • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
    • Fix writing a Predictor=3 file with non-native endianness
    • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
    • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
    • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
    • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
    • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
    • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
    • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
    • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
    • tif_getimage.c: update some integer overflow checks (fixes issue #79)
    • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
    • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
    • LZWDecode(): avoid…
Record
SUSE-SU-2025:20971-1
Updated
2026-11-02
OSVSUSE-SU-2025:21009-1 No score

Security update for tiff

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

  • Software configuration changes:

    • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
    • CMake: define WORDS_BIGENDIAN via tif_config.h
    • doc/CMakeLists.txt: remove useless cmake_minimum_required()
    • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
    • CMake: set CMP0074 new policy
    • Set LINKER_LANGUAGE for C targets with C deps
    • Export tiffxx cmake target (fixes issue #674)
    • autogen.sh: Enable verbose wget.
    • configure.ac: Syntax updates for Autoconf 2.71
    • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
    • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
    • CMake: Add build option tiff-static (fixes issue #709) Library changes:
    • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
    • tif_predict.c: speed-up decompression in some cases.

  • Bug fixes:

    • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
    • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
    • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
    • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
    • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
    • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
    • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
    • Fix writing a Predictor=3 file with non-native endianness
    • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
    • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
    • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
    • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
    • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
    • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
    • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
    • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
    • tif_getimage.c: update some integer overflow checks (fixes issue #79)
    • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
    • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
    • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
    • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
    • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
    • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
    • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
    • tif_jpeg: Fix bug in…
Record
SUSE-SU-2025:21009-1
Updated
2026-11-02
OSVSUSE-SU-2025:21032-1 No score

Security update for tiff

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

  • Software configuration changes:

    • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
    • CMake: define WORDS_BIGENDIAN via tif_config.h
    • doc/CMakeLists.txt: remove useless cmake_minimum_required()
    • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
    • CMake: set CMP0074 new policy
    • Set LINKER_LANGUAGE for C targets with C deps
    • Export tiffxx cmake target (fixes issue #674)
    • autogen.sh: Enable verbose wget.
    • configure.ac: Syntax updates for Autoconf 2.71
    • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
    • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
    • CMake: Add build option tiff-static (fixes issue #709) Library changes:
    • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
    • tif_predict.c: speed-up decompression in some cases.

  • Bug fixes:

    • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
    • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
    • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
    • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
    • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
    • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
    • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
    • Fix writing a Predictor=3 file with non-native endianness
    • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
    • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
    • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
    • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
    • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
    • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
    • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
    • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
    • tif_getimage.c: update some integer overflow checks (fixes issue #79)
    • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
    • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
    • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
    • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
    • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
    • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
    • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
    • tif_jpeg: Fix bug in…
Record
SUSE-SU-2025:21032-1
Updated
2026-11-02
OSVSUSE-SU-2025:21037-1 No score

Security update for tiff

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709)

Library changes:

  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug…
Record
SUSE-SU-2025:21037-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtiff
Azure Linux:3
 before 4.6.0-10
4.6.0-10
libtiff
Azure Linux:2
 before 4.6.0-9
4.6.0-9
tiff
Alpaquita:23
 4.4.0-r1 and later None known
tiff
Alpaquita:25
 4.7.0-r0 up to 4.7.1-r1
4.7.1-r1
tiff
Alpaquita:stream
 4.4.0-r1 up to 4.7.1-r0
4.7.1-r0
tiff
BellSoft Hardened Containers:23
 4.4.0-r1 and later None known
tiff
BellSoft Hardened Containers:25
 4.7.0-r0 up to 4.7.1-r1
4.7.1-r1
tiff
BellSoft Hardened Containers:stream
 4.4.0-r1 up to 4.7.1-r0
4.7.1-r0
libtiff
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 4.4.0-13.el9_6.2.tuxcare.els10
4.4.0-13.el9_6.2.tuxcare.els10
libtiff-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 4.4.0-13.el9_6.2.tuxcare.els10
4.4.0-13.el9_6.2.tuxcare.els10
Show 52 moreShow less
Affected packages
PackageAffectedFixed
libtiff-static
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 4.4.0-13.el9_6.2.tuxcare.els10
4.4.0-13.el9_6.2.tuxcare.els10
libtiff-tools
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 4.4.0-13.el9_6.2.tuxcare.els10
4.4.0-13.el9_6.2.tuxcare.els10
libtiff
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 4.4.0-8.el9_2.tuxcare.els14
4.4.0-8.el9_2.tuxcare.els14
libtiff-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 4.4.0-8.el9_2.tuxcare.els14
4.4.0-8.el9_2.tuxcare.els14
libtiff-static
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 4.4.0-8.el9_2.tuxcare.els14
4.4.0-8.el9_2.tuxcare.els14
libtiff-tools
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 4.4.0-8.el9_2.tuxcare.els14
4.4.0-8.el9_2.tuxcare.els14
tiff
Debian:12
 All versions, plus listed versions
4.5.0-64.5.0-6+deb12u14.5.0-6+deb12u24.5.0-6+deb12u34.5.0-6+deb12u4
Show 18 moreShow less
4.5.1+git230720-14.5.1+git230720-24.5.1+git230720-34.5.1+git230720-44.5.1+git230720-54.5.1-14.5.1~rc3-14.6.0-14.6.0-24.7.0-14.7.0-24.7.0-34.7.0-44.7.0-54.7.1-14.7.1-24.7.1-34.7.2-1
 None known
tiff
Debian:13
 before 4.7.0-3+deb13u1, plus listed versions
4.7.0-3
4.7.0-3+deb13u1
tiff
Debian:14
 before 4.7.0-4, plus listed versions
4.7.0-3
4.7.0-4
tiff
Debian:11
From an advisory covering 2 CVEs
 before 4.2.0-1+deb11u7, plus listed versions
4.2.0-14.2.0-1+deb11u14.2.0-1+deb11u24.2.0-1+deb11u34.2.0-1+deb11u44.2.0-1+deb11u54.2.0-1+deb11u6
4.2.0-1+deb11u7
Libtiff_jll
Julia
 before 4.7.2+0
4.7.2+0
libtiff
Mageia:9
From an advisory covering 7 CVEs
 before 4.5.1-1.6.mga9
4.5.1-1.6.mga9
libtiff
openEuler:22.03-LTS-SP4
 before 4.3.0-40.oe2203sp4
4.3.0-40.oe2203sp4
libtiff
openEuler:24.03-LTS
 before 4.6.0-4.oe2403sp2
4.6.0-4.oe2403sp2
libtiff
openEuler:24.03-LTS-SP1
 before 4.6.0-4.oe2403sp1
4.6.0-4.oe2403sp1
libtiff
openEuler:24.03-LTS-SP2
 before 4.6.0-4.oe2403sp2
4.6.0-4.oe2403sp2
libtiff
openEuler:20.03-LTS-SP4
 before 4.3.0-26.oe2003sp4
4.3.0-26.oe2003sp4
libtiff
openEuler:22.03-LTS-SP3
 before 4.3.0-40.oe2203sp3
4.3.0-40.oe2203sp3
tiff
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 4 CVEs
 before 4.7.0-150600.3.18.1
4.7.0-150600.3.18.1
tiff
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 4 CVEs
 before 4.7.0-150600.3.18.1
4.7.0-150600.3.18.1
tiff
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 4 CVEs
 before 4.7.0-150600.3.18.1
4.7.0-150600.3.18.1
tiff
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 4 CVEs
 before 4.7.0-150600.3.18.1
4.7.0-150600.3.18.1
tiff
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 4.7.0-150600.3.18.1
4.7.0-150600.3.18.1
tiff
SUSE:Linux Micro 6.1
From an advisory covering 9 CVEs
 before 4.7.1-slfo.1.1_1.1
4.7.1-slfo.1.1_1.1
tiff
SUSE:Linux Enterprise Server 16.0
From an advisory covering 7 CVEs
 before 4.7.1-160000.1.1
4.7.1-160000.1.1
tiff
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 4.7.1-160000.1.1
4.7.1-160000.1.1
tiff
SUSE:Linux Micro 6.2
From an advisory covering 7 CVEs
 before 4.7.1-160000.1.1
4.7.1-160000.1.1
tiff
SUSE:Linux Micro 6.0
From an advisory covering 9 CVEs
 before 4.7.1-1.1
4.7.1-1.1
gdal
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.9.0-3.1ubuntu41.9.0-3.1ubuntu61.10.1+dfsg-21.10.1+dfsg-2build11.10.1+dfsg-3
Show 8 moreShow less
1.10.1+dfsg-3build11.10.1+dfsg-3build21.10.1+dfsg-3ubuntu11.10.1+dfsg-3ubuntu21.10.1+dfsg-5ubuntu11.10.1+dfsg-5ubuntu1+esm11.10.1+dfsg-5ubuntu1+esm21.10.1+dfsg-5ubuntu1+esm3
 None known
gdal
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.11.2+dfsg-3ubuntu31.11.2+dfsg-3ubuntu41.11.3+dfsg-2build11.11.3+dfsg-2build21.11.3+dfsg-2build3
Show 5 moreShow less
1.11.3+dfsg-31.11.3+dfsg-3build11.11.3+dfsg-3build21.11.3+dfsg-3ubuntu0.1~esm11.11.3+dfsg-3ubuntu0.1~esm2
 None known
texmaker
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.4.1-14.4.1-1.1
 None known
neuron
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.5-1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1
 None known
texmaker
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1
 None known
neuron
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.6.3-1build27.6.3-1build37.6.3-1build4
 None known
qtwebengine-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7
Show 4 moreShow less
5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1
 None known
texmaker
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1
 None known
neuron
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.6.3-1build57.6.3-1build6
 None known
qtwebengine-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1
Show 4 moreShow less
5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1
 None known
texmaker
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1
 None known
qtwebengine-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1
 None known
texmaker
Ubuntu:25.10
 All versions, plus listed versions
5.1.3+dfsg-35.1.3+dfsg-3build1
 None known
tiff
Ubuntu:25.10
 before 4.7.0-3ubuntu2, plus listed versions
4.5.1+git230720-4ubuntu44.7.0-3ubuntu1
4.7.0-3ubuntu2
qtwebengine-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7
 None known
texmaker
Ubuntu:26.10
 All versions, plus listed versions
6.0.1+dfsg-3build16.0.1+dfsg-3build2
 None known
texmaker
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.1.3+dfsg-3build16.0.1+dfsg-36.0.1+dfsg-3build1
 None known
qtwebengine-opensource-src
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1
 None known
tiff
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 4.7.0-8.1
4.7.0-8.1
tiff
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 4.7.1-160000.1.1
4.7.1-160000.1.1
tiff-man
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 4.7.1-160000.1.1
4.7.1-160000.1.1

History

History
RecordedChangedSources
affectedOSV
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-13978 is a low vulnerability (CVSS 2.0) in Libtiff, published August 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in libtiff 4.6.0-10.

References

Show 43 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open