CVE-2025-9165

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used.(CVE-2025-9165)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used.(CVE-2025-9165)

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

A vulnerability was found in LibTIFF up to version 4.5.1. The issue affects the readSeparateStripsetoBuffer function in the tools/tiffcrop.c file of the tiffcrop component. The manipulation leads to a stack-based buffer overflow. Local access is required to exploit this vulnerability.(CVE-2025-8851)

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used.(CVE-2025-9165)

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".

• CVE-2024-13978: reject zero tile width/length in t2p_read_tiff_init
• CVE-2025-9165: close the first file when tiffcmp cannot open the second

• CVE-2024-13978: NULL pointer dereference in tiff2pdf t2p_read_tiff_init() on a tiled TIFF declaring a zero tile width or length
• CVE-2025-9165: memory leak in tiffcmp when the second input file cannot be opened

LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference. (CVE-2024-13978) LibTIFF tiffmedian.c get_histogram use after free. (CVE-2025-8176) LibTIFF thumbnail.c setrow buffer overflow. (CVE-2025-8177) libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference. (CVE-2025-8534) LibTIFF tiffcrop tiffcrop.c main memory corruption. (CVE-2025-8961) LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak. (CVE-2025-9165) Libtiff: libtiff write-what-where. (CVE-2025-9900)

These are all security issues fixed in the libtiff-devel-32bit-4.7.0-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tkimg-2.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
• CVE-2024-13978: null pointer dereference in component fax2ps (bsc#1247581)
• CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
• CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).

This update for tiff fixes the following issues:

• Update to 4.7.1: Security:
  • CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow() when processing malformed TIFF files (bsc#1247106)
  • CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)
  • CVE-2024-13978: libtiff: Fixed LibTIFF Null Pointer Dereference (bsc#1247581)
  • CVE-2025-8534: Fixed null pointer dereference in function PS_Lvl2page (bsc#1247582)
  • CVE-2025-8961: Fixed segmentation fault via main function of tiffcrop utility (bsc#1248117)
  • CVE-2025-9165: libtiff: Fixed local execution manipulation leading to memory leak (bsc#1248330)
  • CVE-2025-9900: libtiff: Fixed Write-What-Where via TIFFReadRGBAImageOriented (bsc#1250413) Software configuration changes:
  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases. Bug fixes:
  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:

  • Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
  • CMake: define WORDS_BIGENDIAN via tif_config.h
  • doc/CMakeLists.txt: remove useless cmake_minimum_required()
  • CMake: fix build with LLVM/Clang 17 (fixes issue #651)
  • CMake: set CMP0074 new policy
  • Set LINKER_LANGUAGE for C targets with C deps
  • Export tiffxx cmake target (fixes issue #674)
  • autogen.sh: Enable verbose wget.
  • configure.ac: Syntax updates for Autoconf 2.71
  • autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
  • CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
  • CMake: Add build option tiff-static (fixes issue #709) Library changes:
  • Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
  • tif_predict.c: speed-up decompression in some cases.

• Bug fixes:

  • tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
  • Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
  • tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
  • TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
  • Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
  • TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
  • tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
  • Fix writing a Predictor=3 file with non-native endianness
  • _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
  • read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
  • tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
  • tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
  • Fix memory leak in TIFFSetupStrips() (fixes issue #665)
  • tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
  • Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
  • tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
  • tif_getimage.c: update some integer overflow checks (fixes issue #79)
  • tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
  • TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
  • Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
  • LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
  • TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
  • TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
  • JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
  • tif_jpeg: Fix bug in…

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

Software configuration changes:

• Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
• CMake: define WORDS_BIGENDIAN via tif_config.h
• doc/CMakeLists.txt: remove useless cmake_minimum_required()
• CMake: fix build with LLVM/Clang 17 (fixes issue #651)
• CMake: set CMP0074 new policy
• Set LINKER_LANGUAGE for C targets with C deps
• Export tiffxx cmake target (fixes issue #674)
• autogen.sh: Enable verbose wget.
• configure.ac: Syntax updates for Autoconf 2.71
• autogen.sh: Re-implement based on autoreconf. Failure to update config.guess/config.sub does not return error (fixes issue #672)
• CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
• CMake: Add build option tiff-static (fixes issue #709)

Library changes:

• Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control about emitting warnings for unknown tags. No longer emit warnings about unknown tags by default
• tif_predict.c: speed-up decompression in some cases.

Bug fixes:

• tif_fax3: For fax group 3 data if no EOL is detected, reading is retried without synchronisation for EOLs. (fixes issue #54)
• Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
• tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in the DNG 1.7 specification
• TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
• Do not error out on a tag whose tag count value is zero, just issue a warning. Fix parsing a private tag 0x80a6 (fixes issue #647)
• TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24 Fixes https://github.com/OSGeo/gdal/issues/10875)
• tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
• Fix writing a Predictor=3 file with non-native endianness
• _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
• read / nullptr dereference) in case of out-of-memory situation when dealing with custom tags (fixes issue #663)
• tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and PlanarConfiguration = Contiguous (fixes issue #26)
• tif_fax3.c: error out after a number of times end-of-line or unexpected bad code words have been reached. (fixes issue #670)
• Fix memory leak in TIFFSetupStrips() (fixes issue #665)
• tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with -DZ_SOLO inflating will fail.
• Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
• tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction" is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
• tif_getimage.c: update some integer overflow checks (fixes issue #79)
• tif_getimage.c: Fix buffer underflow crash for less raster rows at TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
• TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
• Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative() if HAVE_IEEEFP is not defined. (fixes issue #699)
• LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker has been found with remaining output bytes (fixes issue #698)
• TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
• TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing tif_rawdata (fixes issue #711)
• JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid out-of-bounds access (fixes issue #714)
• tif_jpeg: Fix bug…

Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF images. An attacker could possibly use this issue to cause LibTIFF to crash, resulting in a denial of service. (CVE-2025-8961)

Xudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF image headers. An attacker could possibly use this issue to cause LibTIFF to leak memory, resulting in a denial of service. (CVE-2025-9165)

It was discovered that LibTIFF incorrectly handled memory when parsing malformed TIFF image metadata. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2025-9900)