*** This bug is a security vulnerability *** Public security bug reported:
Affected package is 'libtiff6' As of Ubuntu 26.04 Resolute, I expect security update for main packages, including libtiff6. More over actual version 4.7.0 is pretty old, and lacks a lot of bugfix from upstream. - Security : CVE-2025-61144 : https://nvd.nist.gov/vuln/detail/cve-2025-61144 , affects libtiff 4.7.0 (fixed in 4.7.1) Among some others also affecting 4.7.0 : CVE-2025-8176, CVE-2025-8177, CVE-2024-13978, CVE-2025-61143, CVE-2025-61145 - Bugfixes : Version 4.7.1 has been released on September 12th 2025 - see release note : http://www.simplesystems.org/libtiff/releases/v4.7.1.html Version 4.7.2 has been released on June 27th 2026 - see release note : http://www.simplesystems.org/libtiff/releases/v4.7.2.html Actual 4.7.0 is unable to process TIFF image that worked well with Ubuntu 24.04 (libtiff6 4.5.1), e.g. : - https://gitlab.com/libtiff/libtiff/-/work_items/647 : TIFF produced by ancient software Oi/GFS can't be read - https://gitlab.com/libtiff/libtiff/-/work_items/706 : Tiff image conversion with magick no longer works with tiff:ignore-tags - https://gitlab.com/libtiff/libtiff/-/merge_requests/668 : TIFFMergeFieldInfo can no longer be used to ignore tags I expect at least libtiff6 4.7.1 could be available through resolute-update Would be great to also have libtiff6 4.7.2 available through resolute-backport ** Affects: libtiff Importance: Unknown Status: Unknown ** Affects: tiff (Ubuntu) Importance: Undecided Status: New ** Information type changed from Private Security to Public Security ** Bug watch added: Debian Bug tracker #1149347 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149347 ** Also affects: libtiff via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149347 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170083 Title: outdated libtiff6 vulnerable to critical CVE To manage notifications about this bug go to: https://bugs.launchpad.net/libtiff/+bug/2170083/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
