{"schemaVersion":3,"id":"USN-7783-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"tiff vulnerabilities\n\nXudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled\nmemory when parsing malformed TIFF images. An attacker could possibly use\nthis issue to cause LibTIFF to crash, resulting in a denial of service.\n(CVE-2025-8961)\n\nXudong Cao and Yuqing Zhang discovered that LibTIFF incorrectly handled\nmemory when parsing malformed TIFF image headers. An attacker could\npossibly use this issue to cause LibTIFF to leak memory, resulting in a\ndenial of service. (CVE-2025-9165)\n\nIt was discovered that LibTIFF incorrectly handled memory when parsing\nmalformed TIFF image metadata. An attacker could possibly use this issue to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. (CVE-2025-9900)","dates":{"published":"2025-09-29T14:08:03.000Z","modified":"2026-06-25T13:32:31.255Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"tiff","name":"tiff","label":"tiff","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/tiff","purlType":"deb","versions":[{"text":"< 4.0.3-7ubuntu0.11+esm16","noFixRecorded":false,"fixedIn":null},{"text":"< 4.0.6-1ubuntu0.8+esm19","noFixRecorded":false,"fixedIn":null},{"text":"< 4.0.9-5ubuntu0.10+esm9","noFixRecorded":false,"fixedIn":null},{"text":"< 4.1.0+git191117-2ubuntu0.20.04.14+esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 4.3.0-6ubuntu0.12","noFixRecorded":false,"fixedIn":null},{"text":"< 4.5.1+git230720-4ubuntu2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.3-7ubuntu0.11+esm16 | < 4.0.6-1ubuntu0.8+esm19 | < 4.0.9-5ubuntu0.10+esm9 | < 4.1.0+git191117-2ubuntu0.20.04.14+esm2 | < 4.3.0-6ubuntu0.12 | < 4.5.1+git230720-4ubuntu2.4","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7783-1","label":"ubuntu.com/security/notices/USN-7783-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-8961","label":"ubuntu.com/security/CVE-2025-8961","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-9165","label":"ubuntu.com/security/CVE-2025-9165","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-9900","label":"ubuntu.com/security/CVE-2025-9900","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2025-8961","CVE-2025-9165","CVE-2025-9900"],"downstream":[],"duplicates":[],"related":["CVE-2025-8961","CVE-2025-9165","CVE-2025-9900"]},"timeline":[{"kind":"published","date":"2025-09-29T14:08:03.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-25T13:32:31.255Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:43:48.533Z","stale":false,"partial":false}}