1"use strict";(self.webpackChunkspectro_cloud_docs=self.webpackChunkspectro_cloud_docs||[]).push([["13539"],{265737:function(e,t,i){i.r(t),i.d(t,{frontMatter:()=>l,toc:()=>d,default:()=>h,metadata:()=>s,assets:()=>a,contentTitle:()=>c});var s=JSON.parse('{"id":"security-bulletins/reports/vc-cve-2025-8177","title":"CVE-2025-8177","description":"Lifecycle of CVE-2025-8177","source":"@site/docs/docs-content/security-bulletins/reports/vc-cve-2025-8177.md","sourceDirName":"security-bulletins/reports","slug":"/security-bulletins/reports/vc-cve-2025-8177","permalink":"/security-bulletins/reports/vc-cve-2025-8177","draft":false,"unlisted":false,"editUrl":"https://github.com/spectrocloud/librarium/blob/master/docs/docs-content/security-bulletins/reports/vc-cve-2025-8177.md","tags":[{"inline":true,"label":"security","permalink":"/tags/security"},{"inline":true,"label":"cve","permalink":"/tags/cve"}],"version":"current","lastUpdatedAt":null,"frontMatter":{"sidebar_label":"CVE-2025-8177","title":"CVE-2025-8177","description":"Lifecycle of CVE-2025-8177","sidebar_class_name":"hide-from-sidebar","hide_table_of_contents":false,"toc_max_heading_level":2,"tags":["security","cve"]},"sidebar":"docSidebar","previous":{"title":"CVE-2025-8176","permalink":"/security-bulletins/reports/vc-cve-2025-8176"},"next":{"title":"CVE-2026-2781","permalink":"/security-bulletins/reports/vc-cve-2026-2781"}}'),r=i(474848),n=i(884429);let l={sidebar_label:"CVE-2025-8177",title:"CVE-2025-8177",description:"Lifecycle of CVE-2025-8177",sidebar_class_name:"hide-from-sidebar",hide_table_of_contents:!1,toc_max_heading_level:2,tags:["security","cve"]},c,a={},d=[{value:"CVE Details",id:"cve-details",level:2},{value:"Initial Publication",id:"initial-publication",level:2},{value:"Last Update",id:"last-update",level:2},{value:"Third Party Dependency",id:"third-party-dependency",level:2},{value:"NIST CVE Summary",id:"nist-cve-summary",level:2},{value:"CVE Severity",id:"cve-severity",level:2},{value:"Our Official Summary",id:"our-official-summary",level:2},{value:"Status",id:"status",level:2},{value:"Affected Products & Versions",id:"affected-products--versions",level:2},{value:"Revision History",id:"revision-history",level:2}];function o(e){let t={a:"a",h2:"h2",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,n.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h2,{id:"cve-details",children:"CVE Details"}),"\n",(0,r.jsxs)(t.p,{children:["Visit the official vulnerability details page for ",(0,r.jsx)(t.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2025-8177",children:"CVE-2025-8177"})," to learn more."]}),"\n",(0,r.jsx)(t.h2,{id:"initial-publication",children:"Initial Publication"}),"\n",(0,r.jsx)(t.p,{children:"07/29/2025"}),"\n",(0,r.jsx)(t.h2,{id:"last-update",children:"Last Update"}),"\n",(0,r.jsx)(t.p,{children:"04/23/2026"}),"\n",(0,r.jsx)(t.h2,{id:"third-party-dependency",children:"Third Party Dependency"}),"\n",(0,r.jsx)(t.p,{children:"libtiff6"}),"\n",(0,r.jsx)(t.h2,{id:"nist-cve-summary",children:"NIST CVE Summary"}),"\n",(0,r.jsx)(t.p,{children:"A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer."}),"\n",(0,r.jsx)(t.h2,{id:"cve-severity",children:"CVE Severity"}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2025-8177",children:"7.8"})}),"\n",(0,r.jsx)(t.h2,{id:"our-official-summary",children:"Our Official Summary"}),"\n",(0,r.jsx)(t.p,{children:"This is a buffer overflow vulnerability in LibTIFF up to version 4.7.0, specifically affecting the setrow function in the tools/thumbnail.c file. The vulnerability allows local attackers to cause buffer overflow conditions through manipulation of TIFF image processing operations, potentially leading to memory corruption or denial of service. The issue only affects products that are no longer supported by the maintainer."}),"\n",(0,r.jsx)(t.p,{children:"The vulnerability affects UI related images in both Vertex and Palette products, across versions 4.7.4 through 4.7.16. However, successful exploitation requires local access to the system and the ability to provide maliciously crafted TIFF files to applications using the vulnerable LibTIFF functionality, which is typically limited in containerized environments."}),"\n",(0,r.jsx)(t.p,{children:"The risk of exploitation is considered low to medium, as it requires local access and specific conditions where TIFF image processing occurs with untrusted input files. Most containerized applications have restricted file system access and limited exposure to user-prov
1ided image files. The impact if compromised is considered medium as it could result in application crashes or memory corruption within the container context."}),"\n",(0,r.jsx)(t.p,{children:"Upstream patches addressing this issue are available and will be adopted through vendor coordination to remediate the vulnerability across affected container images."}),"\n",(0,r.jsx)(t.h2,{id:"status",children:"Status"}),"\n",(0,r.jsx)(t.p,{children:"Ongoing"}),"\n",(0,r.jsx)(t.h2,{id:"affected-products--versions",children:"Affected Products & Versions"}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Version"}),(0,r.jsx)(t.th,{children:"Palette Enterprise"}),(0,r.jsx)(t.th,{children:"Palette Enterprise Airgap"}),(0,r.jsx)(t.th,{children:"VerteX"}),(0,r.jsx)(t.th,{children:"VerteX Airgap"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"4.8.52"}),(0,r.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,r.jsx)(t.td,{children:"\u2705 No Impact"}),(0,r.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,r.jsx)(t.td,{children:"\u2705 No Impact"})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"4.7.29"}),(0,r.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,r.jsx)(t.td,{children:"\u2705 No Impact"}),(0,r.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,r.jsx)(t.td,{children:"\u2705 No Impact"})]})]})]}),"\n",(0,r.jsx)(t.h2,{id:"revision-history",children:"Revision History"}),"\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{children:"Date"}),(0,r.jsx)(t.th,{children:"Revision"})]})}),(0,r.jsxs)(t.tbody,{children:[(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"09/17/2025"}),(0,r.jsx)(t.td,{children:"Status changed from Open to Ongoing"})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"09/17/2025"}),(0,r.jsx)(t.td,{children:"Official summary added"})]}),(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{children:"09/12/2025"}),(0,r.jsx)(t.td,{children:"Advisory assigned with HIGH severity"})]})]})]})]})}function h(e={}){let{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(o,{...e})}):o(e)}},884429:function(e,t,i){i.d(t,{R:()=>l,x:()=>c});var s=i(296540);let r={},n=s.createContext(r);function l(e){let t=s.useContext(n);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.