<div class="container">
<h1>Security update for tiff</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2025:21032-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2025-11-19T10:29:41Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1243503">bsc#1243503</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247106">bsc#1247106</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247108">bsc#1247108</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247581">bsc#1247581</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247582">bsc#1247582</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248117">bsc#1248117</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248330">bsc#1248330</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1250413">bsc#1250413</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-13978.html">CVE-2024-13978</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-8176.html">CVE-2025-8176</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-8177.html">CVE-2025-8177</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-8534.html">CVE-2025-8534</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-8961.html">CVE-2025-8961</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-9165.html">CVE-2025-9165</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-9900.html">CVE-2025-9900</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-13978</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-13978</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.7</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-13978</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-13978</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8176</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.4</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8176</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8176</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.9</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8176</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8176</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8177</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8177</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8177</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8177</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8177</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8534</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.0</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8534</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8534</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8534</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8961</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8961</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8961</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.9</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-8961</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9165</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9165</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.3</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9165</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">1.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9165</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9900</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.5</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9900</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-9900</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.2</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves seven vulnerabilities and has one fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for tiff fixes the following issues:</p>
<p>tiff was updated to 4.7.1:</p>
<ul>
<li>
<p>Software configuration changes:</p>
</li>
<li>
<p>Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.</p>
</li>
<li>CMake: define WORDS_BIGENDIAN via tif_config.h</li>
<li>doc/CMakeLists.txt: remove useless cmake_minimum_required()</li>
<li>CMake: fix build with LLVM/Clang 17 (fixes issue #651)</li>
<li>CMake: set CMP0074 new policy</li>
<li>Set LINKER_LANGUAGE for C targets with C deps</li>
<li>Export tiffxx cmake target (fixes issue #674)</li>
<li>autogen.sh: Enable verbose wget.</li>
<li>configure.ac: Syntax updates for Autoconf 2.71</li>
<li>autogen.sh: Re-implement based on autoreconf. Failure to update
config.guess/config.sub does not return error (fixes issue #672)</li>
<li>CMake: fix CMake 4.0 warning when minimum required version is < 3.10.</li>
<li>CMake: Add build option tiff-static (fixes issue #709)
Library changes:</li>
<li>Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control
about emitting warnings for unknown tags. No longer emit warnings
about unknown tags by default</li>
<li>
<p>tif_predict.c: speed-up decompression in some cases.</p>
</li>
<li>
<p>Bug fixes:</p>
</li>
<li>
<p>tif_fax3: For fax group 3 data if no EOL is detected, reading is
retried without synchronisation for EOLs. (fixes issue #54)</p>
</li>
<li>Updating TIFFMergeFieldInfo() with read_count=write_count=0 for
FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for
FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)</li>
<li>tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in
the DNG 1.7 specification</li>
<li>TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags
defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)</li>
<li>Do not error out on a tag whose tag count value is zero, just issue a warning.
Fix parsing a private tag 0x80a6 (fixes issue #647)</li>
<li>TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
Fixes https://github.com/OSGeo/gdal/issues/10875)</li>
<li>tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)</li>
<li>Fix writing a Predictor=3 file with non-native endianness</li>
<li>_TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds</li>
<li>read / nullptr dereference) in case of out-of-memory situation when dealing with
custom tags (fixes issue #663)</li>
<li>tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and
PlanarConfiguration = Contiguous (fixes issue #26)</li>
<li>tif_fax3.c: error out after a number of times end-of-line or unexpected bad code
words have been reached. (fixes issue #670)</li>
<li>Fix memory leak in TIFFSetupStrips() (fixes issue #665)</li>
<li>tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with
-DZ_SOLO inflating will fail.</li>
<li>Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)</li>
<li>tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction"
is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)</li>
<li>tif_getimage.c: update some integer overflow checks (fixes issue #79)</li>
<li>tif_getimage.c: Fix buffer underflow crash for less raster rows at
TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)</li>
<li>TIFFReadRGBAImage(): several fixes to avoid buffer overflows.</li>
<li>Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative()
if HAVE_IEEEFP is not defined. (fixes issue #699)</li>
<li>LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker
has been found with remaining output bytes (fixes issue #698)</li>
<li>TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.</li>
<li>TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing
tif_rawdata (fixes issue #711)</li>
<li>JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid
out-of-bounds access (fixes issue #714)</li>
<li>tif_jpeg: Fix bug in JPEGDecodeRaw() if JPEG_LIB_MK1_OR_12BIT is defined for 8/12bit
dual mode, introduced in libjpeg-turbo 2.2, which was actually released as 3.0.
Fixes issue #717</li>
<li>add assert for TIFFReadCustomDirectory infoarray check.</li>
<li>ppm2tiff: Fix bug in pack_words trailing bytes, where last two bytes of each line
were written wrongly. (fixes issue #467)</li>
<li>fax2ps: fix regression of commit 28c38d648b64a66c3218778c4745225fe3e3a06d where
TIFFTAG_FAXFILLFUNC is being used rather than an output buffer (fixes issue #649)</li>
<li>tiff2pdf: Check TIFFTAG_TILELENGTH and TIFFTAGTILEWIDTH (fixes issue #650)</li>
<li>tiff2pdf: check h_samp and v_samp for range 1 to 4 to avoid division by zero.
Fixes issue #654</li>
<li>tiff2pdf: avoid null pointer dereference. (fixes issue #741)</li>
<li>Improve non-secure integer overflow check (comparison of division result with
multiplicant) at compiler optimisation in tiffcp, rgb2ycbcr and tiff2rgba.
Fixes issue #546</li>
<li>tiff2rgba: fix some "a partial expression can generate an overflow before it is
assigned to a broader type" warnings. (fixes issue #682)</li>
<li>tiffdither/tiffmedian: Don't skip the first line of the input image. (fixes issue #703)</li>
<li>tiffdither: avoid out-of-bounds read identified in issue #733</li>
<li>tiffmedian: error out if TIFFReadScanline() fails (fixes issue #707)</li>
<li>tiffmedian: close input file. (fixes issue #735)</li>
<li>thumbail: avoid potential out of bounds access (fixes issue #715)</li>
<li>tiffcrop: close open TIFF files and release allocated buffers before exiting in case
of error to avoid memory leaks. (fixes issue #716)</li>
<li>tiffcrop: fix double-free and memory leak exposed by issue #721</li>
<li>tiffcrop: avoid buffer overflow. (fixes issue #740)</li>
<li>tiffcrop: avoid nullptr dereference. (fixes issue #734)</li>
<li>tiffdump: Fix coverity scan issue CID 1373365: Passing tainted expression *datamem
to PrintData, which uses it as a divisor or modulus.</li>
<li>tiff2ps: check return of TIFFGetFiled() for TIFFTAG_STRIPBYTECOUNTS and
TIFFTAG_TILEBYTECOUNTS to avoid NULL pointer dereference. (fixes issue #718)</li>
<li>tiffcmp: fix memory leak when second file cannot be opened. (fixes issue #718 and issue #729)</li>
<li>tiffcp: fix setting compression level for lossless codecs. (fixes issue #730)</li>
<li>raw2tiff: close input file before exit (fixes issue #742)
Tools changes:</li>
<li>tiffinfo: add a -W switch to warn about unknown tags.</li>
<li>
<p>tiffdither: process all pages in input TIFF file.</p>
</li>
<li>
<p>Documentation:</p>
</li>
<li>
<p>TIFFRGBAImage.rst note added for incorrect saving of images with TIFF orientation
from 5 (LeftTop) to 8 (LeftBottom) in the raster.</p>
</li>
<li>TIFFRGBAImage.rst note added about un-associated alpha handling (fixes issue #67)</li>
<li>Update "Defining New TIFF Tags" description. (fixes issue #642)</li>
<li>Fix return type of TIFFReadEncodedTile()</li>
<li>Update the documentation to reflect deprecated typedefs.</li>
<li>TIFFWriteDirectory.rst: Clarify TIFFSetWriteOffset() only sets offset for image
data and not for IFD data.</li>
<li>Update documentation on re-entrancy and thread safety.</li>
<li>Remove dead links to no more existing Awaresystems web-site.</li>
<li>Updating BigTIFF specification and some miscelaneous editions.</li>
<li>Replace some last links and remove last todos.</li>
<li>Added hints for correct allocation of TIFFYCbCrtoRGB structure and its
associated buffers. (fixes issue #681)</li>
<li>Added chapter to "Using the TIFF Library" with links to handling multi-page TIFF
and custom directories. (fixes issue #43)</li>
<li>update TIFFOpen.rst with the return values of mapproc and unmapproc. (fixes issue #12)</li>
</ul>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2025-8961: Fix segmentation fault via main function of tiffcrop utility [bsc#1248117]</li>
<li>CVE-2025-8534: Fix null pointer dereference in function PS_Lvl2page [bsc#1247582]</li>
<li>CVE-2025-9165: Fix local execution manipulation can lead to memory leak [bsc#1248330]</li>
<li>CVE-2024-13978: Fix null pointer dereference in tiff2pdf [bsc#1247581]</li>
<li>CVE-2025-8176: Fix heap use-after-free in tools/tiffmedian.c [bsc#1247108]</li>
<li>
<p>CVE-2025-8177: Fix possible buffer overflow in tools/thumbnail.c:setrow() [bsc#1247106]</p>
</li>
<li>
<p>Fix TIFFMergeFieldInfo() read_count=write_count=0 (bsc#1243503)</p>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.2
<br/>
<code>zypper in -t patch SUSE-SL-Micro-6.2-23=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
<ul>
<li>tiff-debuginfo-4.7.1-160000.1.1</li>
<li>libtiff6-4.7.1-160000.1.1</li>
<li>tiff-debugsource-4.7.1-160000.1.1</li>
<li>libtiff6-debuginfo-4.7.1-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-13978.html">https://www.suse.com/security/cve/CVE-2024-13978.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-8176.html">https://www.suse.com/security/cve/CVE-2025-8176.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-8177.html">https://www.suse.com/security/cve/CVE-2025-8177.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-8534.html">https://www.suse.com/security/cve/CVE-2025-8534.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-8961.html">https://www.suse.com/security/cve/CVE-2025-8961.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-9165.html">https://www.suse.com/security/cve/CVE-2025-9165.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-9900.html">https://www.suse.com/security/cve/CVE-2025-9900.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1243503">https://bugzilla.suse.com/show_bug.cgi?id=1243503</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247106">https://bugzilla.suse.com/show_bug.cgi?id=1247106</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247108">https://bugzilla.suse.com/show_bug.cgi?id=1247108</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247581">https://bugzilla.suse.com/show_bug.cgi?id=1247581</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1247582">https://bugzilla.suse.com/show_bug.cgi?id=1247582</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248117">https://bugzilla.suse.com/show_bug.cgi?id=1248117</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1248330">https://bugzilla.suse.com/show_bug.cgi?id=1248330</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1250413">https://bugzilla.suse.com/show_bug.cgi?id=1250413</a>
</li>
</ul>
</div>