JLSEC-2025-260

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-260.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-260.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2025-260

Upstream

CVE-2022-0561

Published

2025-11-25T22:18:43.603Z

Modified

2026-07-23T22:30:25.806547577Z

Severity

4.3 (Medium) CVSS_V2 - AV:N/AC:M/Au:N/C:N/I:N/A:P CVSS Calculator
5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in...

Details

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "id": "CVE-2022-0561",
            "published": "2022-02-11T18:15:11.033Z",
            "imported": "2026-07-17T20:52:49.371Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-0561",
            "modified": "2026-06-17T04:20:50.817Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0561",
            "database_specific": {
                "status": "Modified"
            }
        }
    ]
}

References

Affected packages

Julia / Libtiff_jll

Package

Name: Libtiff_jll
Purl: pkg:julia/Libtiff_jll?uuid=89763e89-9b03-5906-acba-b20f662cd828

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.4.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-260.json"