Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2025-0002

NIXPKGS-2025-0002
published on 30 Oct 2025
Permalink CVE-2025-9900
8.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 4 months, 4 weeks ago by @balsoft Activity log
  • Created automatic suggestion 6 months ago
  • @balsoft accepted 4 months, 4 weeks ago
  • @balsoft removed
    3 maintainers
    • @sikmir
    • @imincik
    • @nialov
    4 months, 4 weeks ago
  • @balsoft added maintainer @balsoft 4 months, 4 weeks ago
  • @balsoft published on GitHub 4 months, 4 weeks ago
Libtiff: libtiff write-what-where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

References

Affected products

libtiff
  • <4.7.1
  • *
mingw-libtiff
  • *
compat-libtiff3
  • *
spice-client-win
  • *
rhaiis/vllm-cuda-rhel9
  • *
rhaiis/vllm-rocm-rhel9
  • *
rhaiis/model-opt-cuda-rhel9
  • *
discovery/discovery-ui-rhel9
  • *

Matching in nixpkgs

pkgs.libtiff

Library and utilities for working with the TIFF image file format

Package maintainers

Ignored maintainers (3)

Additional maintainers