libtiff-4.4.0-15.el9_7.2
エラータID: AXSA:2025-11453:10
リリース日:
2025/12/04 Thursday - 19:41
題名:
libtiff-4.4.0-15.el9_7.2
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- libtiff には、メモリ領域の解放後利用の問題があるため、ローカル
の攻撃者により、情報の漏洩、データ破壊、およびサービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2025-8176)
- compat-libtiff3 および mingw-libtiff には、カラー情報のデータ
を任意のメモリ領域に上書きできてしまう問題があるため、リモートの
攻撃者により、巨大な高さのサイズを持つように巧妙に細工されたメタ
データ情報を持つ LIFF 形式のファイルの処理を介して、任意のコード
の実行、およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2025-9900)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-8176
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.
CVE-2025-9900
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
追加情報:
N/A
ダウンロード:
SRPMS
- libtiff-4.4.0-15.el9_7.2.src.rpm
MD5: f8c992cab7e72537d1db2e286e90e2c9
SHA-256: e6999254c2254275f9e4075048e1df6f72fbec4b7e0504db9ed0fe489c76abce
Size: 2.77 MB
Asianux Server 9 for x86_64
- libtiff-4.4.0-15.el9_7.2.i686.rpm
MD5: e83d3a97bc4d12307a96e1c0a69b2e39
SHA-256: 886d5e8ab7ffcdb6d8f9f0fcf8f7a5b30d11a2c1cd739dcca9a5bf4fe36dc764
Size: 213.65 kB - libtiff-4.4.0-15.el9_7.2.x86_64.rpm
MD5: 8060fa5d9dd02bf4304f530779faf7bb
SHA-256: 56a775a74df1316005ea2f4958c0700026824d84f08c9c6a823c6935cebbe4c9
Size: 196.20 kB - libtiff-devel-4.4.0-15.el9_7.2.i686.rpm
MD5: b93df82392a547b175037e8449a361c6
SHA-256: feca4d9f4668eed7664a680a171f418e711f71d06d0b1672a3b5442799ac44af
Size: 573.83 kB - libtiff-devel-4.4.0-15.el9_7.2.x86_64.rpm
MD5: 60556ed53c6d8d7e070f03744b0109fe
SHA-256: ccf513ebaa4c5d117bfb665511e325c92a8d0e7c20a66290f02bc925458c29e9
Size: 573.83 kB - libtiff-tools-4.4.0-15.el9_7.2.x86_64.rpm
MD5: 91264b1e4e3cd5caa61332c113e5529f
SHA-256: 19de62cd4af0c6c88cd059fd708d461f0dc2802a89515a6903e836e140b57d98
Size: 244.25 kB
English