Debian Package Tracker
Register | Log in
Subscribe

tiff

Choose email to subscribe with

general
  • source: tiff (main)
  • version: 4.7.1-1
  • maintainer: Laszlo Boszormenyi (GCS) (DMD)
  • arch: all any
  • std-ver: 4.7.2
  • VCS: unknown
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 4.2.0-1+deb11u5
  • o-o-sec: 4.2.0-1+deb11u7
  • oldstable: 4.5.0-6+deb12u2
  • old-sec: 4.5.0-6+deb12u1
  • stable: 4.7.0-3
  • testing: 4.7.1-1
  • unstable: 4.7.1-1
versioned links
  • 4.2.0-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.2.0-1+deb11u7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.5.0-6+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.5.0-6+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.7.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.7.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libtiff-dev (1 bugs: 0, 0, 1, 0)
  • libtiff-doc
  • libtiff-opengl (1 bugs: 0, 1, 0, 0)
  • libtiff-tools (13 bugs: 0, 10, 3, 0)
  • libtiff5-dev (1 bugs: 0, 1, 0, 0)
  • libtiff6
  • libtiffxx6
action needed
2 security issues in trixie high

There are 2 open security issues in trixie.

1 important issue:
  • CVE-2025-9900: A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
1 issue left for the package maintainer to handle:
  • CVE-2024-13978: (needs triaging) A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-08-15 Last update: 2025-10-02 04:31
4 security issues in bookworm high

There are 4 open security issues in bookworm.

1 important issue:
  • CVE-2025-9900: A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
1 issue left for the package maintainer to handle:
  • CVE-2024-13978: (needs triaging) A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

You can find information about how to handle this issue in the security team's documentation.

2 ignored issues:
  • CVE-2023-6277: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
  • CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
Created: 2023-06-20 Last update: 2025-10-02 04:31
3 bugs tagged patch in the BTS normal
The BTS contains patches fixing 3 bugs, consider including or untagging them.
Created: 2025-01-06 Last update: 2025-10-05 05:31
lintian reports 8 warnings normal
Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-09-22 Last update: 2025-09-22 06:03
news
[rss feed]
  • [2025-09-29] Accepted tiff 4.2.0-1+deb11u7 (source) into oldoldstable-security (Jochen Sprickerhof)
  • [2025-09-26] tiff 4.7.1-1 MIGRATED to testing (Debian testing watch)
  • [2025-09-21] Accepted tiff 4.7.1-1 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-09-14] tiff 4.7.0-5 MIGRATED to testing (Debian testing watch)
  • [2025-09-10] Accepted tiff 4.7.0-5 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-08-26] tiff 4.7.0-4 MIGRATED to testing (Debian testing watch)
  • [2025-08-24] Accepted tiff 4.7.0-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-04-10] tiff 4.7.0-3 MIGRATED to testing (Debian testing watch)
  • [2025-04-05] Accepted tiff 4.7.0-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-04-02] tiff 4.7.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-03-28] Accepted tiff 4.7.0-2 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-03-27] Accepted tiff 4.7.0-1 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-01-20] Accepted tiff 4.2.0-1+deb11u6 (source) into oldstable-security (Adrian Bunk)
  • [2025-01-03] Accepted tiff 4.5.0-6+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
  • [2024-08-18] tiff 4.5.1+git230720-5 MIGRATED to testing (Debian testing watch)
  • [2024-08-15] Accepted tiff 4.5.1+git230720-5 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2024-03-11] Accepted tiff 4.1.0+git191117-2~deb10u9 (source) into oldoldstable (Abhijith PA)
  • [2024-01-31] tiff 4.5.1+git230720-4 MIGRATED to testing (Debian testing watch)
  • [2024-01-27] Accepted tiff 4.5.1+git230720-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-12-13] Accepted tiff 4.2.0-1+deb11u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-12-10] tiff 4.5.1+git230720-3 MIGRATED to testing (Debian testing watch)
  • [2023-12-03] Accepted tiff 4.5.1+git230720-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-11-29] Accepted tiff 4.5.0-6+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-27] Accepted tiff 4.5.0-6+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-27] Accepted tiff 4.2.0-1+deb11u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-26] Accepted tiff 4.6.0-2 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-11-26] Accepted tiff 4.5.1+git230720-2 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-09-14] Accepted tiff 4.6.0-1 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-08-04] tiff 4.5.1+git230720-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-31] Accepted tiff 4.1.0+git191117-2~deb10u8 (source) into oldoldstable (Adrian Bunk)
  • 1
  • 2
bugs [bug history graph]
  • all: 25
  • RC: 0
  • I&N: 18
  • M&W: 6
  • F&P: 1
  • patch: 3
links
  • homepage
  • lintian (0, 8)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 4.7.0-3ubuntu2
  • 25 bugs
  • patches for 4.7.0-3ubuntu3

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing