Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2025-9900

Libtiff: libtiff write-what-where

HIGH 8.8

En bref

Source
NVD
EPSS
EPSS 0.97 % · centile 62 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Description

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Faiblesses (CWE)

  • CWE-123 — Write-what-where Condition

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
libtiffaffected 0 < 4.7.1
Red Hat · Red Hat Enterprise Linux 10unaffected 0:4.6.0-6.el10_0.1 < *
Red Hat · Red Hat Enterprise Linux 10unaffected 0:4.6.0-6.el10_1.1 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:3.9.4-12.el7_9.1 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:4.0.3-35.el7_9.1 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:3.9.4-14.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:4.0.9-35.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:4.0.9-3.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:3.9.4-13.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:4.0.9-17.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:8.10-3.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:3.9.4-13.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:4.0.9-18.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:8.10-3.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:3.9.4-13.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:4.0.9-18.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:8.10-3.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:3.9.4-13.el8_6.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:4.0.9-21.el8_6.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:8.10-3.el8_6.1 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD