{
  "document": {
    "aggregate_severity": {
      "text": "Low"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2025/cve-2025-9165-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-21T18:54:18Z",
      "generator": {
        "date": "2026-10-21T18:54:18Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-9165-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2025-08-19T20:15:00Z",
      "revision_history": [
        {
          "date": "2025-08-19T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-21T18:54:18Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2025-9165"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-0:3.9.4-21.el6_8.i686",
                "product": {
                  "name": "libtiff-0:3.9.4-21.el6_8.i686",
                  "product_id": "libtiff-0:3.9.4-21.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff@3.9.4-21.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-0:3.9.4-21.el6_8.i686",
                "product": {
                  "name": "libtiff-devel-0:3.9.4-21.el6_8.i686",
                  "product_id": "libtiff-devel-0:3.9.4-21.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff-devel@3.9.4-21.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-static-0:3.9.4-21.el6_8.i686",
                "product": {
                  "name": "libtiff-static-0:3.9.4-21.el6_8.i686",
                  "product_id": "libtiff-static-0:3.9.4-21.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff-static@3.9.4-21.el6_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-0:3.9.4-21.el6_8.x86_64",
                "product": {
                  "name": "libtiff-0:3.9.4-21.el6_8.x86_64",
                  "product_id": "libtiff-0:3.9.4-21.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff@3.9.4-21.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-0:3.9.4-21.el6_8.x86_64",
                "product": {
                  "name": "libtiff-devel-0:3.9.4-21.el6_8.x86_64",
                  "product_id": "libtiff-devel-0:3.9.4-21.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff-devel@3.9.4-21.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-static-0:3.9.4-21.el6_8.x86_64",
                "product": {
                  "name": "libtiff-static-0:3.9.4-21.el6_8.x86_64",
                  "product_id": "libtiff-static-0:3.9.4-21.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libtiff-static@3.9.4-21.el6_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                "product": {
                  "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_id": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff@3.9.4-21.el6_8.tuxcare.els5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                "product": {
                  "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_id": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff-devel@3.9.4-21.el6_8.tuxcare.els5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                "product": {
                  "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_id": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff-static@3.9.4-21.el6_8.tuxcare.els5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                "product": {
                  "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_id": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff@3.9.4-21.el6_8.tuxcare.els5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                "product": {
                  "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_id": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff-devel@3.9.4-21.el6_8.tuxcare.els5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                "product": {
                  "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_id": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libtiff-static@3.9.4-21.el6_8.tuxcare.els5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686"
        },
        "product_reference": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-0:3.9.4-21.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.i686"
        },
        "product_reference": "libtiff-0:3.9.4-21.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64"
        },
        "product_reference": "libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-0:3.9.4-21.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.x86_64"
        },
        "product_reference": "libtiff-0:3.9.4-21.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64"
        },
        "product_reference": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-0:3.9.4-21.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.x86_64"
        },
        "product_reference": "libtiff-devel-0:3.9.4-21.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686"
        },
        "product_reference": "libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-devel-0:3.9.4-21.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.i686"
        },
        "product_reference": "libtiff-devel-0:3.9.4-21.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686"
        },
        "product_reference": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-static-0:3.9.4-21.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.i686"
        },
        "product_reference": "libtiff-static-0:3.9.4-21.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64"
        },
        "product_reference": "libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtiff-static-0:3.9.4-21.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.x86_64"
        },
        "product_reference": "libtiff-static-0:3.9.4-21.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9165",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because \"this is a memory leak on a command line tool that is about to exit anyway\". In the reply the project maintainer declares this issue as \"a simple 'bug' when leaving the command line tool and (...) not a security issue at all\".",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.i686",
          "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
          "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
          "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.x86_64",
          "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.i686",
          "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
          "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
          "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.x86_64",
          "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.i686",
          "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
          "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
          "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-9165"
        },
        {
          "category": "external",
          "summary": "http://www.libtiff.org/",
          "url": "http://www.libtiff.org/"
        },
        {
          "category": "external",
          "summary": "https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing",
          "url": "https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0",
          "url": "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libtiff/libtiff/-/issues/728",
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/728"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/747",
          "url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/747"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.320543",
          "url": "https://vuldb.com/?ctiid.320543"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.320543",
          "url": "https://vuldb.com/?id.320543"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.630506",
          "url": "https://vuldb.com/?submit.630506"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.630507",
          "url": "https://vuldb.com/?submit.630507"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libtiff/libtiff/-/issues/728#note_2709263214",
          "url": "https://gitlab.com/libtiff/libtiff/-/issues/728#note_2709263214"
        }
      ],
      "release_date": "2025-08-19T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T10:08:39.682383Z",
          "details": "CVE-2025-9165 is a memory-leak bug confined to the standalone tiffcmp command-line tool (not the libtiff runtime library), and it requires a local user to explicitly run tiffcmp on crafted input with no network exposure. Its impact is limited to transient memory consumption in the short‑lived tiffcmp process—no code execution, privilege escalation, or confidentiality/integrity impact—so it cannot compromise services or data. In enterprise server/VM environments where production workloads do not execute this utility, the practical risk is negligible and this CVE can be safely deprioritized.",
          "product_ids": [
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.x86_64",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.x86_64",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-0:3.9.4-21.el6_8.x86_64",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-devel-0:3.9.4-21.el6_8.x86_64",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.i686",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.i686",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.tuxcare.els5.x86_64",
            "Oracle-Linux-6:libtiff-static-0:3.9.4-21.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ]
    }
  ]
}