Vulnerability-Lookup

OESA-2025-2049 (CVE-2025-8534)

Vulnerability from osv_openeuler – Published: 2025-08-15 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

libtiff security update

Details

This provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.

Security Fix(es):

LibTIFF is a library for reading and writing TIFF (label image file format) files that are open source. This library contains some command-line tools for handling TIFF files. There is a security vulnerability in the 4.6.0 version of LibTIFF, which originates from the dereference of the null pointer of the function PS_Lvl2page in the file tools/tiff2ps.c.(CVE-2025-8534)

Severity

2.5 (Low)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8534	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libtiff-4.3.0-41.oe2203sp4.aarch64.rpm",
          "libtiff-debuginfo-4.3.0-41.oe2203sp4.aarch64.rpm",
          "libtiff-debugsource-4.3.0-41.oe2203sp4.aarch64.rpm",
          "libtiff-devel-4.3.0-41.oe2203sp4.aarch64.rpm",
          "libtiff-static-4.3.0-41.oe2203sp4.aarch64.rpm",
          "libtiff-tools-4.3.0-41.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "libtiff-help-4.3.0-41.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "libtiff-4.3.0-41.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "libtiff-4.3.0-41.oe2203sp4.x86_64.rpm",
          "libtiff-debuginfo-4.3.0-41.oe2203sp4.x86_64.rpm",
          "libtiff-debugsource-4.3.0-41.oe2203sp4.x86_64.rpm",
          "libtiff-devel-4.3.0-41.oe2203sp4.x86_64.rpm",
          "libtiff-static-4.3.0-41.oe2203sp4.x86_64.rpm",
          "libtiff-tools-4.3.0-41.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "libtiff",
        "purl": "pkg:rpm/openEuler/libtiff\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0-41.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Low"
  },
  "details": "This  provides support for the Tag Image File Format (TIFF), a widely\nused format for storing image data. The latest version of the TIFF specification\nis available on-line in several different formats.And contains command-line programs\nfor manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\nLibTIFF is a library for reading and writing TIFF (label image file format) files that are open source. This library contains some command-line tools for handling TIFF files.\n There is a security vulnerability in the 4.6.0 version of LibTIFF, which originates from the dereference of the null pointer of the function PS_Lvl2page in the file tools/tiff2ps.c.(CVE-2025-8534)",
  "id": "OESA-2025-2049",
  "modified": "2026-08-06T11:09:07Z",
  "published": "2025-08-15T11:09:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2049"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8534"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libtiff security update",
  "upstream": [
    "CVE-2025-8534"
  ]
}

CVE-2025-8534 (GCVE-0-2025-8534)

Vulnerability from cvelistv5 – Published: 2025-08-04 23:32 – Updated: 2025-08-05 15:26

Title

libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference

Summary

A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

2.5 (Low)


                        
                          CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-05 15:26 UTC

CWE

CWE-476 - NULL Pointer Dereference
CWE-404 - Denial of Service

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/?id.318664	vdb-entrytechnical-description
https://vuldb.com/?ctiid.318664	signaturepermissions-required
https://vuldb.com/?submit.617831	third-party-advisory
https://gitlab.com/libtiff/libtiff/-/issues/718	issue-tracking
https://gitlab.com/libtiff/libtiff/-/merge_requests/746	patch
https://drive.google.com/file/d/15JPA3kLYiYD-nRNJ…	exploit
https://gitlab.com/libtiff/libtiff/-/commit/6ba36…	patch
http://www.libtiff.org/	product

Impacted products

1 product

Vendor	Product	Version
n/a	libtiff	Affected: 4.6.0

Credits

rootsec (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8534",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-05T15:26:00.191345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-05T15:26:03.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/?submit.617831"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.com/libtiff/libtiff/-/issues/718"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "tiff2ps"
          ],
          "product": "libtiff",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.6.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rootsec (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that \"[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. \"rD\") option is used.\""
        },
        {
          "lang": "de",
          "value": "In libtiff 4.6.0 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Hierbei betrifft es die Funktion PS_Lvl2page der Datei tools/tiff2ps.c der Komponente tiff2ps. Mittels dem Manipulieren mit unbekannten Daten kann eine null pointer dereference-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs hat dabei lokal zu erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als 6ba36f159fd396ad11bf6b7874554197736ecc8b bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1,
            "vectorString": "AV:L/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T23:32:08.491Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-318664 | libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.318664"
        },
        {
          "name": "VDB-318664 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.318664"
        },
        {
          "name": "Submit #617831 | libtiff tiff2ps  4.6.0 \u0026\u0026 the newest master SEGV",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.617831"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/718"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/746"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://drive.google.com/file/d/15JPA3kLYiYD-nRNJ8y8HmnYjhv9NE7k6/view?usp=drive_link"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "http://www.libtiff.org/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-08-04T14:00:29.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-8534",
    "datePublished": "2025-08-04T23:32:08.491Z",
    "dateReserved": "2025-08-04T11:55:24.506Z",
    "dateUpdated": "2025-08-05T15:26:03.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2025-2049 (CVE-2025-8534)

CVE-2025-8534 (GCVE-0-2025-8534)

Tags

Sightings

Nomenclature

Related by attack behaviour