Critical Security Update for libtiff: Addressing Write-What-Where Vulnerability
Summary
ALSA-2025:20998: Important: libtiff security update. Affects libtiff versions < 4.6.0-6.el10_1.1. Fixed in 4.6.0-6.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is a widely used library that provides functions for manipulating Tagged Image File Format (TIFF) files. It is essential for applications that require image processing and manipulation, offering features such as reading, writing, and converting TIFF images. However, vulnerabilities in this library can pose significant security risks, particularly when handling untrusted TIFF files.
Vulnerability Detail
The vulnerability identified as CVE-2025-9900 is a Write-What-Where vulnerability in libtiff. This flaw allows an attacker to manipulate memory in a way that could lead to arbitrary code execution or data corruption. The vulnerability arises from improper handling of certain TIFF file operations, which can be exploited by crafting malicious TIFF files. If successfully exploited, this could compromise the integrity and confidentiality of the system, leading to severe consequences.
How To Fix
Minimum fixed version
4.6.0-6.el10_1.1
This is the first release that contains the fix.
sudo dnf update libtiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to applications that utilize libtiff or validating TIFF files before processing them to mitigate potential exploitation. However, these are temporary measures and should not replace a proper update.
Conclusion
The libtiff library has a critical vulnerability (CVE-2025-9900) that requires immediate attention. Users are advised to update to the latest patched version to protect their systems from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libtiff →
FAQ
CVE-2025-9900 is a security vulnerability in the libtiff library that allows attackers to exploit memory handling issues, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, data corruption, and compromise of system integrity and confidentiality.
Yes, a patch is available in version 4.6.0-6.el10_1.1 and later of the libtiff package.
If you cannot update immediately, consider restricting access to applications using libtiff and validating TIFF files before processing them as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libtiff.
