Debian Package Tracker
Register | Log in
Subscribe

tiff

Choose email to subscribe with

general
  • source: tiff (main)
  • version: 4.7.0-5
  • maintainer: Laszlo Boszormenyi (GCS) (DMD)
  • arch: all any
  • std-ver: 4.7.2
  • VCS: unknown
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 4.2.0-1+deb11u5
  • o-o-sec: 4.2.0-1+deb11u6
  • oldstable: 4.5.0-6+deb12u2
  • old-sec: 4.5.0-6+deb12u1
  • stable: 4.7.0-3
  • testing: 4.7.0-4
  • unstable: 4.7.0-5
versioned links
  • 4.2.0-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.2.0-1+deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.5.0-6+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.5.0-6+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.7.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.7.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 4.7.0-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libtiff-dev (1 bugs: 0, 0, 1, 0)
  • libtiff-doc
  • libtiff-opengl (1 bugs: 0, 1, 0, 0)
  • libtiff-tools (13 bugs: 0, 10, 3, 0)
  • libtiff5-dev (1 bugs: 0, 1, 0, 0)
  • libtiff6
  • libtiffxx6
action needed
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2025-8961: A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
Created: 2025-08-15 Last update: 2025-09-10 23:27
3 bugs tagged patch in the BTS normal
The BTS contains patches fixing 3 bugs, consider including or untagging them.
Created: 2025-01-06 Last update: 2025-09-12 07:32
lintian reports 8 warnings normal
Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-09-11 Last update: 2025-09-11 04:34
debian/patches: 5 patches to forward upstream low

Among the 5 debian patches available in version 4.7.0-5 of the package, we noticed the following issues:

  • 5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2025-03-28 Last update: 2025-09-11 08:31
2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:
  • CVE-2025-8961: (needs triaging) A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
  • CVE-2024-13978: (needs triaging) A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-15 Last update: 2025-09-10 23:27
4 low-priority security issues in bookworm low

There are 4 open security issues in bookworm.

2 issues left for the package maintainer to handle:
  • CVE-2025-8961: (needs triaging) A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
  • CVE-2024-13978: (needs triaging) A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.

You can find information about how to handle these issues in the security team's documentation.

2 ignored issues:
  • CVE-2023-6277: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.
  • CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
Created: 2023-06-20 Last update: 2025-09-10 23:27
testing migrations
  • excuses:
    • Migration status for tiff (4.7.0-4 to 4.7.0-5): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ autopkgtest for cmake/4.1.1+really3.31.6-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), riscv64: Test triggered (failure will be ignored), s390x: Pass
    • ∙ ∙ autopkgtest for hugin/2024.0.1+dfsg-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Pass
    • ∙ ∙ autopkgtest for libreoffice/4:25.8.1-1: amd64: Pass, arm64: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Test triggered (failure will be ignored), riscv64: Pass, s390x: Pass
    • ∙ ∙ Too young, only 1 of 2 days old
    • Additional info:
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/t/tiff.html
    • ∙ ∙ Reproducible on amd64 - info ♻
    • ∙ ∙ Reproducible on arm64 - info ♻
    • Not considered
news
[rss feed]
  • [2025-09-10] Accepted tiff 4.7.0-5 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-08-26] tiff 4.7.0-4 MIGRATED to testing (Debian testing watch)
  • [2025-08-24] Accepted tiff 4.7.0-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-04-10] tiff 4.7.0-3 MIGRATED to testing (Debian testing watch)
  • [2025-04-05] Accepted tiff 4.7.0-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-04-02] tiff 4.7.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-03-28] Accepted tiff 4.7.0-2 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-03-27] Accepted tiff 4.7.0-1 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2025-01-20] Accepted tiff 4.2.0-1+deb11u6 (source) into oldstable-security (Adrian Bunk)
  • [2025-01-03] Accepted tiff 4.5.0-6+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
  • [2024-08-18] tiff 4.5.1+git230720-5 MIGRATED to testing (Debian testing watch)
  • [2024-08-15] Accepted tiff 4.5.1+git230720-5 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2024-03-11] Accepted tiff 4.1.0+git191117-2~deb10u9 (source) into oldoldstable (Abhijith PA)
  • [2024-01-31] tiff 4.5.1+git230720-4 MIGRATED to testing (Debian testing watch)
  • [2024-01-27] Accepted tiff 4.5.1+git230720-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-12-13] Accepted tiff 4.2.0-1+deb11u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-12-10] tiff 4.5.1+git230720-3 MIGRATED to testing (Debian testing watch)
  • [2023-12-03] Accepted tiff 4.5.1+git230720-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-11-29] Accepted tiff 4.5.0-6+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-27] Accepted tiff 4.5.0-6+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-27] Accepted tiff 4.2.0-1+deb11u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Aron Xu)
  • [2023-11-26] Accepted tiff 4.6.0-2 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-11-26] Accepted tiff 4.5.1+git230720-2 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-09-14] Accepted tiff 4.6.0-1 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-08-04] tiff 4.5.1+git230720-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-31] Accepted tiff 4.1.0+git191117-2~deb10u8 (source) into oldoldstable (Adrian Bunk)
  • [2023-07-30] Accepted tiff 4.5.1+git230720-1 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-06-27] tiff 4.5.1-1 MIGRATED to testing (Debian testing watch)
  • [2023-06-21] Accepted tiff 4.5.1-1 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
  • [2023-06-20] tiff 4.5.1~rc3-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 25
  • RC: 0
  • I&N: 18
  • M&W: 6
  • F&P: 1
  • patch: 3
links
  • homepage
  • lintian (0, 8)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 4.7.0-3ubuntu2
  • 25 bugs
  • patches for 4.7.0-3ubuntu2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing