Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.309 Vulnerability Details CVEID:CVE-2025-9900 DESCRIPTION: A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafte...

CLSA-2025-1764886460 libtiff: Fix of CVE-2025-8177

CVE-2025-8177: fix buffer overflow in tools/thumbnail.c...

K000158069: LibTIFF vulnerability CVE-2023-6277

Security Advisory Description An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. CVE-2023-6277 Impact There is no impact; F5 products are not affected by...

Oracle Linux 10 : libtiff (ELSA-2025-20998)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20998 advisory. 4.6.0-6.1 - Fix buffer underflow in TIFFReadRGBAImageOriented. - Resolves: RHEL-112524 Tenable has extracted the preceding description block directly from the...

K000158048: LibTIFF vulnerability CVE-2023-52356

Security Advisory Description A segment fault SEGV flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. CVE-2023-52356 Impact There is no...

Oracle Linux 9 : libtiff (ELSA-2025-20956)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20956 advisory. - fix CVE-2025-8176: tiffdither and tiffmedian skip first line of input images RHEL-120239 Tenable has extracted the preceding description block...

Advisory ROSA-SA-2025-3096

Software: libtiff 4.0.9 OS: ROSA Virtualization 2.1 packageevrstring: libtiff-4.0.9-33.rv3 CVE-ID: CVE-2018-15209 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in LibTIFF allows remote attackers to cause a denial of service or execute arbitrary code via a specially crafted TIFF file...

Oracle Linux 7 : libtiff (ELSA-2025-21407)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21407 advisory. - fix CVE-2025-8176: prevent skipping first line in tiffdither and tiffmedian tools Orabug: 38658716 - fix CVE-2025-8177: buffer overflow thumbnail...

libtiff security update

4.0.3-35.0.1 - fix CVE-2025-8176: prevent skipping first line in tiffdither and tiffmedian tools Orabug: 38658716 - fix CVE-2025-8177: buffer overflow thumbnail setrow Orabug: 38658716 - fix CVE-2025-9900: buffer underflow crash in TIFFReadRGBAImageOriented Orabug: 38658716...

K000157988: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2022-3570 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosur...

K000157989: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2016-9453 The t2preadwritepdfimagetile function in LibTIFF allows remote attackers to cause a denial of service out-of-bounds write and crash or possibly execute arbitrary code via a JPEG file with a TIFFTAGJPEGTABLES of length one. CVE-2016-5323 The...

K000157987: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2022-0891 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential...

K000157985: LibTIFF vulnerabilities CVE-2020-35522, CVE-2020-35521, CVE-2020-35524, and CVE-2020-35523

Security Advisory Description CVE-2020-35522 In LibTIFF, there is a memory malloc failure in tifpixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack. CVE-2020-35521 A flaw was found in libtiff. Due to a memory allocation failure in tifread.c, a...

K000157984: Multiple LibTIFF vulnerabilities

Security Advisory Description CVE-2012-4564 ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory...

JLSEC-2025-312 LibTIFF is vulnerable to an integer overflow

LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service application crash or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow...

JLSEC-2025-318 A vulnerability was found in LibTIFF up to 4.7.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It...

JLSEC-2025-285 LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in `tools/tiffcrop.c:7345`, allowing...

LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125...

JLSEC-2025-283 LibTIFF 4.4.0 has an out-of-bounds write in `_TIFFmemcpy` in `libtiff/tif_unix.c:346` when called...

LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit...

JLSEC-2025-292 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in `libtiff/tif_unix.c:368`, invoked by...

LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tifunix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e...

JLSEC-2025-282 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows...

Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact...