PT-2025-32545 · Libtiff+6 · Libtiff+6

Arthurx · Published 2025-01-01 · Updated 2026-03-31 · CVE-2025-8851

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: LibTIFF versions prior to 4.5.1

Description: A stack-based buffer overflow issue exists in the tiffcrop component of LibTIFF, specifically within the readSeparateStripsetoBuffer function located in the tools/tiffcrop.c file. Local access is required for exploitation.

Recommendations: Apply the patch identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

ALT-PU-2025-11161

ALT-PU-2025-11213

ALT-PU-2025-11483

AZL-66258

AZL-66282

BDU:2025-13922

CVE-2025-8851

ECHO-0263-9519-53E9

OESA-2025-2048

OESA-2025-2091

OESA-2025-2192

OPENSUSE-SU-2025:15556-1

OPENSUSE-SU-2025:15682-1

SUSE-SU-2025:3957-1

SUSE-SU-2025:3989-1

SUSE-SU-2025_3957-1

SUSE-SU-2025_3989-1

USN-7707-1

Affected Products

Alt Linux

Debian

Libtiff

Linuxmint

Red Os

Suse

Ubuntu

References · 48

• 🔥 https://vuldb.com/?submit.624604 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:3989-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7707-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3957-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2192 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15556-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2091 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66258 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9165 · Security Note
• https://ubuntu.com/security/CVE-2025-8176 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8534 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8851 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8851 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8851 · Vendor Advisory