CVE-2025-8961

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference. (CVE-2024-13978) LibTIFF tiffmedian.c get_histogram use after free. (CVE-2025-8176) LibTIFF thumbnail.c setrow buffer overflow. (CVE-2025-8177) libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference. (CVE-2025-8534) LibTIFF tiffcrop tiffcrop.c main memory corruption. (CVE-2025-8961) LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak. (CVE-2025-9165) Libtiff: libtiff write-what-where. (CVE-2025-9900)

These are all security issues fixed in the libtiff-devel-32bit-4.7.0-9.1 package on the GA media of openSUSE Tumbleweed.

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

Root has patched CVE-2025-8961 in the tiff package for Root:Debian:12. Multiple fixed versions available.

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2024-13978: null pointer dereference in component fax2ps (bsc#1247581)
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• Update to 4.7.1: Security:
  • CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow() when processing malformed TIFF files (bsc#1247106)
  • CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)
  • CVE-2024-13978: libtiff: Fixed LibTIFF Null Pointer Dereference (bsc#1247581)
  • CVE-2025-8534: Fixed null pointer dereference in function PS_Lvl2page (bsc#1247582)
  • CVE-2025-8961: Fixed segmentation fault via main function of tiffcrop utility (bsc#1248117)
  • CVE-2025-9165: libtiff: Fixed local execution manipulation leading to memory leak (bsc#1248330)
  • CVE-2025-9900: libtiff: Fixed Write-What-Where via TIFFReadRGBAImageOriented (bsc#1250413) Software configuration changes:
  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases. Bug fixes:
  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

Software configuration changes:

• Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
• CMake: define WORDS_BIGENDIAN via tif_config.h
• doc/CMakeLists.txt: remove useless cmake_minimum_required()
• CMake: fix build with LLVM/Clang 17 (fixes issue #651)
• CMake: set CMP0074 new policy
• Set LINKER_LANGUAGE for C targets with C deps
• Export tiffxx cmake target (fixes issue #674)
• autogen.sh: Enable verbose wget.
• configure.ac: Syntax updates for Autoconf 2.71
• autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
• CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
• CMake: Add build option tiff-static (fixes issue #709)

Library changes:

• Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
• tif_predict.c: speed-up decompression in some cases.

Bug fixes:

• tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
• Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
• tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
• TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
• Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
• TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
• tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
• Fix writing a Predictor=3 file with non-native endianness
• _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
• read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
• tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
• tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
• Fix memory leak in TIFFSetupStrips() (fixes issue #665)
• tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
• Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
• tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
• tif_getimage.c: update some integer overflow checks (fixes issue #79)
• tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
• TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
• Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
• LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
• TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
• TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
• JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
• tif_jpeg: Fix bug…

Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF images. An attacker could possibly use this issue to cause LibTIFF to crash, resulting in a denial of service. (CVE-2025-8961)

Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF image headers. An attacker could possibly use this issue to cause LibTIFF to leak memory, resulting in a denial of service. (CVE-2025-9165)

It was discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF image metadata. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2025-9900)