The following updates has been released for Debian GNU/Linux 7 LTS:

DLA 1377-1: tiff security update
DLA 1378-1: tiff3 security update

DLA 1377-1: tiff security update

Package : tiff
Version : 4.0.2-6+deb7u20
CVE ID : CVE-2018-8905
Debian Bug : 893806

A heap-based buffer overflow was discovered in the LZWDecodeCompat
function in tif_lzw.c (LibTIFF 4.0.9 and earlier). This vulnerability
might be leveraged by remote attackers to crash the client via a
crafted TIFF LZW file.

For Debian 7 "Wheezy", these problems have been fixed in version
4.0.2-6+deb7u20.

We recommend that you upgrade your tiff packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1378-1: tiff3 security update

Package : tiff3
Version : 3.9.6-11+deb7u11
CVE ID : CVE-2018-8905
Debian Bug : 893806

A heap-based buffer overflow was discovered in the LZWDecodeCompat
function in tif_lzw.c (LibTIFF 4.0.9 and earlier). This vulnerability
might be leveraged by remote attackers to crash the client via a
crafted TIFF LZW file.

For Debian 7 "Wheezy", these problems have been fixed in version
3.9.6-11+deb7u11.

We recommend that you upgrade your tiff3 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS