Red Hat Product Errata RHSA-2025:21507 - Security Advisory
Issued:
2025-11-17
Updated:
2025-11-17

RHSA-2025:21507 - Security Advisory

Synopsis

Important: libtiff security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libtiff is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

  • libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176)
  • libtiff: Libtiff Write-What-Where (CVE-2025-9900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

  • BZ - 2383598 - CVE-2025-8176 libtiff: LibTIFF Use-After-Free Vulnerability
  • BZ - 2392784 - CVE-2025-9900 libtiff: Libtiff Write-What-Where

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
x86_64
libtiff-4.4.0-12.el9_4.4.i686.rpm SHA-256: f562c16dc9e1acd17e9f3e6421cbe5a5f84c996df4680644596ffcef4f261509
libtiff-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: bbdcac872a6b09355b92318438e2ee4048c248f987ffb999c25579fd85e10003
libtiff-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: 920aaa4d0fce38da17290e234c76807450280fc0080c281485afac23d526357d
libtiff-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: e379db21a7b6b3a055e3923ad840c86ede53eb95e5541f6166c880dd94bdbda3
libtiff-debugsource-4.4.0-12.el9_4.4.i686.rpm SHA-256: 748542b378df75e9a8e2d0447c8e275ff4e33040fcf8f249ec55036463afba9a
libtiff-debugsource-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 98d3ec4d215d8778baa145b924f7df2c6ecb82c6ce3d82494fbd1d5314d62ddf
libtiff-devel-4.4.0-12.el9_4.4.i686.rpm SHA-256: 78f44346c752ce82ef701862c99c7cc1ea8bb3a34786c64481a3f8928dd35ec8
libtiff-devel-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 893fcaaa9e4a1dc8a7ee96abc5c55bd80dfbb9796cdd97f519cb162791f08f6e
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: dd935227a56ff80a646a74d43dae52328fae2e3973f1140ffd9830b56d485537
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 1ae5dc9d2ae870f7ef829f7a2665b129c18bfdace7f09f0ac386efcc2ae9bf8d

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
x86_64
libtiff-4.4.0-12.el9_4.4.i686.rpm SHA-256: f562c16dc9e1acd17e9f3e6421cbe5a5f84c996df4680644596ffcef4f261509
libtiff-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: bbdcac872a6b09355b92318438e2ee4048c248f987ffb999c25579fd85e10003
libtiff-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: 920aaa4d0fce38da17290e234c76807450280fc0080c281485afac23d526357d
libtiff-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: e379db21a7b6b3a055e3923ad840c86ede53eb95e5541f6166c880dd94bdbda3
libtiff-debugsource-4.4.0-12.el9_4.4.i686.rpm SHA-256: 748542b378df75e9a8e2d0447c8e275ff4e33040fcf8f249ec55036463afba9a
libtiff-debugsource-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 98d3ec4d215d8778baa145b924f7df2c6ecb82c6ce3d82494fbd1d5314d62ddf
libtiff-devel-4.4.0-12.el9_4.4.i686.rpm SHA-256: 78f44346c752ce82ef701862c99c7cc1ea8bb3a34786c64481a3f8928dd35ec8
libtiff-devel-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 893fcaaa9e4a1dc8a7ee96abc5c55bd80dfbb9796cdd97f519cb162791f08f6e
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: dd935227a56ff80a646a74d43dae52328fae2e3973f1140ffd9830b56d485537
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 1ae5dc9d2ae870f7ef829f7a2665b129c18bfdace7f09f0ac386efcc2ae9bf8d

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
s390x
libtiff-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 36c3c754d4130a81c180b8e821e7f2510c17553adfb1e3498b528056a23a4284
libtiff-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 3a645ba6bfeddf8d3d576241f582b8f97dff20af79c7d1b74550ee458284c21e
libtiff-debugsource-4.4.0-12.el9_4.4.s390x.rpm SHA-256: f376a1c56dbce5013f806da7069cebbcf51c4f1917555eab2a3f266cdeb55d3b
libtiff-devel-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 814f57842d6402afe8ff2e50b6483c93ef83de0daba3e7580788039d605b22d0
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: fde60094041326312048185f5247cfc68c04a184123fefd68dae3a2249c0d36e

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
ppc64le
libtiff-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 9b6db1c1e24b3778b6fcedcbd3a0119a9ff8cd6295c09364c0ee53fcf15d7c7f
libtiff-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 86949769e5fca6aa83ff1e6f96a33b14dc3663ec4d836fd562c9b3bcc3ff6b59
libtiff-debugsource-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: ac0f252e73e5878c0f24262e26fa3b1947da63fb5bf34a89f507cbab9534fad9
libtiff-devel-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: c90eb29bbb5d5c82dd40427e82dac75e685d883e27d3aae808d9eb6250422e18
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 72465a8a371d295a89ffdad87e25fb85124a92f4a89bca39ab28dc95cbbb8147

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
aarch64
libtiff-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 9b3b9483cca5dc9c92f47d9c0e8e6ab9dfa3dac6580084f23a7419b9de2ab74e
libtiff-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: f06d4f4a49e8b7d91d1f41e8f409741a889a6c40d8636846ea48f3536d4634a6
libtiff-debugsource-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 93d41b3a2041c03a70f1161601479d768f4456fda2642a7ee90897aa72f38bae
libtiff-devel-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: c58a4cf16d1e9c09f77c807a8bbc9d3a7a1a4801a64733c623ceb499d0bc90d1
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 3400883549fdc19e5b63f71ef6e653fa6fde1d99f46c9039247e7f27fb76326a

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
ppc64le
libtiff-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 9b6db1c1e24b3778b6fcedcbd3a0119a9ff8cd6295c09364c0ee53fcf15d7c7f
libtiff-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 86949769e5fca6aa83ff1e6f96a33b14dc3663ec4d836fd562c9b3bcc3ff6b59
libtiff-debugsource-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: ac0f252e73e5878c0f24262e26fa3b1947da63fb5bf34a89f507cbab9534fad9
libtiff-devel-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: c90eb29bbb5d5c82dd40427e82dac75e685d883e27d3aae808d9eb6250422e18
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 72465a8a371d295a89ffdad87e25fb85124a92f4a89bca39ab28dc95cbbb8147

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
x86_64
libtiff-4.4.0-12.el9_4.4.i686.rpm SHA-256: f562c16dc9e1acd17e9f3e6421cbe5a5f84c996df4680644596ffcef4f261509
libtiff-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: bbdcac872a6b09355b92318438e2ee4048c248f987ffb999c25579fd85e10003
libtiff-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: 920aaa4d0fce38da17290e234c76807450280fc0080c281485afac23d526357d
libtiff-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: e379db21a7b6b3a055e3923ad840c86ede53eb95e5541f6166c880dd94bdbda3
libtiff-debugsource-4.4.0-12.el9_4.4.i686.rpm SHA-256: 748542b378df75e9a8e2d0447c8e275ff4e33040fcf8f249ec55036463afba9a
libtiff-debugsource-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 98d3ec4d215d8778baa145b924f7df2c6ecb82c6ce3d82494fbd1d5314d62ddf
libtiff-devel-4.4.0-12.el9_4.4.i686.rpm SHA-256: 78f44346c752ce82ef701862c99c7cc1ea8bb3a34786c64481a3f8928dd35ec8
libtiff-devel-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 893fcaaa9e4a1dc8a7ee96abc5c55bd80dfbb9796cdd97f519cb162791f08f6e
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.i686.rpm SHA-256: dd935227a56ff80a646a74d43dae52328fae2e3973f1140ffd9830b56d485537
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 1ae5dc9d2ae870f7ef829f7a2665b129c18bfdace7f09f0ac386efcc2ae9bf8d

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4

SRPM
x86_64
libtiff-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: e379db21a7b6b3a055e3923ad840c86ede53eb95e5541f6166c880dd94bdbda3
libtiff-debugsource-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 98d3ec4d215d8778baa145b924f7df2c6ecb82c6ce3d82494fbd1d5314d62ddf
libtiff-tools-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 702ab5dcafec93b1875c6dc5381cbaea587a31c78f1988907c378a9c1e7d8cbc
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.x86_64.rpm SHA-256: 1ae5dc9d2ae870f7ef829f7a2665b129c18bfdace7f09f0ac386efcc2ae9bf8d

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4

SRPM
ppc64le
libtiff-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 86949769e5fca6aa83ff1e6f96a33b14dc3663ec4d836fd562c9b3bcc3ff6b59
libtiff-debugsource-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: ac0f252e73e5878c0f24262e26fa3b1947da63fb5bf34a89f507cbab9534fad9
libtiff-tools-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: d2c6f98e337b84111e8c67d207429a94e2d4ce7ec5b3761bfac34c27b538b44f
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.ppc64le.rpm SHA-256: 72465a8a371d295a89ffdad87e25fb85124a92f4a89bca39ab28dc95cbbb8147

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4

SRPM
s390x
libtiff-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 3a645ba6bfeddf8d3d576241f582b8f97dff20af79c7d1b74550ee458284c21e
libtiff-debugsource-4.4.0-12.el9_4.4.s390x.rpm SHA-256: f376a1c56dbce5013f806da7069cebbcf51c4f1917555eab2a3f266cdeb55d3b
libtiff-tools-4.4.0-12.el9_4.4.s390x.rpm SHA-256: e0c7b4d76322ec2c1d011a6b6c1e37a56d880f8c4877197869f743bdd6ddd978
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: fde60094041326312048185f5247cfc68c04a184123fefd68dae3a2249c0d36e

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4

SRPM
aarch64
libtiff-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: f06d4f4a49e8b7d91d1f41e8f409741a889a6c40d8636846ea48f3536d4634a6
libtiff-debugsource-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 93d41b3a2041c03a70f1161601479d768f4456fda2642a7ee90897aa72f38bae
libtiff-tools-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: f1f86ab51966189f3fe29643a2bd34cb92adcd84d53aac7554b126594da9da3d
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 3400883549fdc19e5b63f71ef6e653fa6fde1d99f46c9039247e7f27fb76326a

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
aarch64
libtiff-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 9b3b9483cca5dc9c92f47d9c0e8e6ab9dfa3dac6580084f23a7419b9de2ab74e
libtiff-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: f06d4f4a49e8b7d91d1f41e8f409741a889a6c40d8636846ea48f3536d4634a6
libtiff-debugsource-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 93d41b3a2041c03a70f1161601479d768f4456fda2642a7ee90897aa72f38bae
libtiff-devel-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: c58a4cf16d1e9c09f77c807a8bbc9d3a7a1a4801a64733c623ceb499d0bc90d1
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.aarch64.rpm SHA-256: 3400883549fdc19e5b63f71ef6e653fa6fde1d99f46c9039247e7f27fb76326a

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
libtiff-4.4.0-12.el9_4.4.src.rpm SHA-256: 56f0e8a23f44451bec4f76494d988a6bdd5748ad3c5ee61258a594fbc914669d
s390x
libtiff-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 36c3c754d4130a81c180b8e821e7f2510c17553adfb1e3498b528056a23a4284
libtiff-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 3a645ba6bfeddf8d3d576241f582b8f97dff20af79c7d1b74550ee458284c21e
libtiff-debugsource-4.4.0-12.el9_4.4.s390x.rpm SHA-256: f376a1c56dbce5013f806da7069cebbcf51c4f1917555eab2a3f266cdeb55d3b
libtiff-devel-4.4.0-12.el9_4.4.s390x.rpm SHA-256: 814f57842d6402afe8ff2e50b6483c93ef83de0daba3e7580788039d605b22d0
libtiff-tools-debuginfo-4.4.0-12.el9_4.4.s390x.rpm SHA-256: fde60094041326312048185f5247cfc68c04a184123fefd68dae3a2249c0d36e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.