CVE-2025-8534
Fixed in a distro release EPSS <1%CVSS 2.5
A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."
Products: libtiff
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | tiff | no fix |
| Debian 13 | tiff | no fix |
| Debian 14 | tiff | 4.7.1-1 |
| SUSE Linux Enterprise Micro 5.2 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Micro 5.3 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Micro 5.4 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Micro 5.5 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | tiff | 4.7.0-150600.3.18.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | tiff | 4.7.0-150600.3.18.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | tiff | 4.0.9-150000.45.55.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | tiff | 4.7.0-150600.3.18.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | tiff | 4.7.0-150600.3.18.1 |
| SUSE Linux Enterprise Server 16.0 | tiff | 4.7.1-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tiff | 4.0.9-44.94.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | tiff | 4.7.1-160000.1.1 |
| SUSE Linux Micro 6.0 | tiff | 4.7.1-1.1 |
| SUSE Linux Micro 6.1 | tiff | 4.7.1-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | tiff | 4.7.1-160000.1.1 |
| Ubuntu 16.04 LTS | texmaker | no fix |
| Ubuntu 18.04 LTS | neuron | no fix |
| Ubuntu 20.04 LTS | neuron | no fix |
| Ubuntu 22.04 LTS | neuron | no fix |
| Ubuntu 22.04 LTS | tiff | 4.3.0-6ubuntu0.11 |
| Ubuntu 24.04 LTS | tiff | 4.5.1+git230720-4ubuntu2.3 |
| Ubuntu 25.10 | qtwebengine-opensource-src | no fix |
| Ubuntu 25.10 | texmaker | no fix |
| Ubuntu 25.10 | tiff | 4.7.0-3ubuntu2 |
| Ubuntu 26.04 LTS | texmaker | no fix |
| Ubuntu 26.10 | qtwebengine-opensource-src | no fix |
| Ubuntu 26.10 | texmaker | no fix |
| Ubuntu Pro 14.04 LTS | gdal | no fix |
| Ubuntu Pro 14.04 LTS | tiff | 4.0.3-7ubuntu0.11+esm15 |
| Ubuntu Pro 16.04 LTS | gdal | no fix |
| Ubuntu Pro 16.04 LTS | tiff | 4.0.6-1ubuntu0.8+esm18 |
| Ubuntu Pro 18.04 LTS | qtwebengine-opensource-src | no fix |
| Ubuntu Pro 18.04 LTS | texmaker | no fix |
| Ubuntu Pro 18.04 LTS | tiff | 4.0.9-5ubuntu0.10+esm8 |
| Ubuntu Pro 20.04 LTS | qtwebengine-opensource-src | no fix |
| Ubuntu Pro 20.04 LTS | texmaker | no fix |
| Ubuntu Pro 20.04 LTS | tiff | 4.1.0+git191117-2ubuntu0.20.04.14+esm1 |
| Ubuntu Pro 22.04 LTS | qtwebengine-opensource-src | no fix |
| Ubuntu Pro 22.04 LTS | texmaker | no fix |
| Ubuntu Pro 24.04 LTS | qtwebengine-opensource-src | no fix |
| Ubuntu Pro 24.04 LTS | texmaker | no fix |
| Ubuntu Pro 26.04 LTS | qtwebengine-opensource-src | no fix |
| openSUSE Leap 15.6 | tiff | 4.7.0-150600.3.18.1 |
| openSUSE Leap 16.0 | tiff | 4.7.1-160000.1.1 |
| openSUSE Leap 16.0 | tiff-man | 4.7.1-160000.1.1 |
| openSUSE Tumbleweed | tiff | 4.7.0-8.1 |