deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40175
Published: 2025-11-12
Description: In the Linux kernel, the following vulnerability has been resolved:

idpf: cleanup remaining SKBs in PTP flows

When the driver requests Tx timestamp value, one of the first steps is
to clone SKB using skb_get. It increases the reference counter for that
SKB to prevent unexpected freeing by another component.
However, there may be a case where the index is requested, SKB is
assigned and never consumed by PTP flows - for example due to reset during
running PTP apps.

Add a check in release timestamping function to verify if the SKB
assigned to Tx timestamp latch was freed, and release remaining SKBs.
References: https://git.kernel.org/stable/c/2c84e91ef831d4fedb0b94670b3cfd1cc5f966a5; https://git.kernel.org/stable/c/a3f8c0a273120fd2638f03403e786c3de2382e72
CVE: CVE-2025-40176
Published: 2025-11-12
Description: In the Linux kernel, the following vulnerability has been resolved:

tls: wait for pending async decryptions if tls_strp_msg_hold fails

Async decryption calls tls_strp_msg_hold to create a clone of the
input skb to hold references to the memory it uses. If we fail to
allocate that clone, proceeding with async decryption can lead to
various issues (UAF on the skb, writing into userspace memory after
the recv() call has returned).

In this case, wait for all pending decryption requests.
References: https://git.kernel.org/stable/c/39dec4ea3daf77f684308576baf483b55ca7f160; https://git.kernel.org/stable/c/4fc109d0ab196bd943b[PII_REDACTED]fb6bb48c2e0; https://git.kernel.org/stable/c/9f83fd0c179e0f458e824e417f9d5ad53443f685
CVE: CVE-2025-40177
Published: 2025-11-12
Description: In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Fix bootlog initialization ordering

As soon as we queue MHI buffers to receive the bootlog from the device,
we could be receiving data. Therefore all the resources needed to
process that data need to be setup prior to queuing the buffers.

We currently initialize some of the resources after queuing the buffers
which creates a race between the probe() and any data that comes back
from the device. If the uninitialized resources are accessed, we could
see page faults.

Fix the init ordering to close the race.
References: https://git.kernel.org/stable/c/48814afc7372f96a9584125c8508dffc88d1d378; https://git.kernel.org/stable/c/646868e6962b14e25ae7462fdd1fb061b40c1f16; https://git.kernel.org/stable/c/fd6e385528d8f85993b7bfc[PII_REDACTED]bb14c65
CVE: CVE-2025-12998
Published: 2025-11-12
Description: Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
CWE: CWE-287
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-015
CVE: CVE-2025-62876
Published: 2025-11-12
Description: A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects  lightdm-kde-greeter. before 6.0.4.
CWE: CWE-250
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62876; http://www.openwall.com/lists/oss-security/2025/11/17/4
CVE: CVE-2025-11565
Published: 2025-11-12
Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE: CVE-2025-11566
Published: 2025-11-12
Description: CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.
CWE: CWE-307
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE: CVE-2025-11567
Published: 2025-11-12
Description: CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.
CWE: CWE-276
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE: CVE-2025-63666
Published: 2025-11-12
Description: Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/Remenis/CVE-2025-63666
CVE: CVE-2025-63667
Published: 2025-11-12
Description: Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/Remenis/CVE-2025-63667; https://github.com/Remenis/Vatilon_evidence/releases/download/Evidence/Vatilon_vulnerability_evidence_2025.zip; https://vatilon.com/
CVE: CVE-2025-11366
Published: 2025-11-12
Description: N-central < 2025.4 is vulnerable to authentication bypass via path traversal
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://me.n-able.com/s/security-advisory/aArVy0000000rcDKAQ/cve202511366-ncentral-authentication-bypass-via-path-traversal
CVE: CVE-2025-11367
Published: 2025-11-12
Description: The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://me.n-able.com/s/security-advisory/aArVy0000000rfRKAQ/cve202511367-ncentral-windows-software-probe-remote-code-execution
CVE: CVE-2025-11700
Published: 2025-11-12
Description: N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://me.n-able.com/s/security-advisory/aArVy0000000rabKAA
CVE: CVE-2025-12068
Published: 2025-11-12
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-12152
Published: 2025-11-12
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-63289
Published: 2025-11-12
Description: Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-321
References: https://medium.com/@sudosu01/information-disclosure-hardcoded-encryption-keys-fc375abf68a3; https://www.linkedin.com/in/umanhonlengabriel
CVE: CVE-2025-63353
Published: 2025-11-12
Description: A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/hanianis/CVE-2025-63353; https://medium.com/@hanianis.bouzid/fiberhome-gpon-onu-model-hg6145f1-router-predictable-wifi-passwords-and-real-risks-d8e54da385d3
CVE: CVE-2025-64280
Published: 2025-11-12
Description: A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://centralsquare.com; https://machevalia.blog/blog/multiple-vulnerabilities-in-centralsquare-etrakit-and-ivr
CVE: CVE-2025-64281
Published: 2025-11-12
Description: An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://centralsquare.com; https://machevalia.blog/blog/multiple-vulnerabilities-in-centralsquare-etrakit-and-ivr
CVE: CVE-2025-64293
Published: 2025-11-12
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/0-day-analytics/vulnerability/wordpress-0-day-analytics-plugin-4-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-9316
Published: 2025-11-12
Description: N-central < 2025.4 can generate sessionIDs for unauthenticated users





This issue affects N-central: before 2025.4.
CWE: CWE-1284
References: https://me.n-able.com/s/security-advisory/aArVy0000000rdpKAA/cve20259316-ncentral-unauthenticated-sessionid-generation
CVE: CVE-2025-11795
Published: 2025-11-12
Description: A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023
CVE: CVE-2025-11797
Published: 2025-11-12
Description: A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0023
CVE: CVE-2025-13042
Published: 2025-11-12
Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_11.html; https://issues.chromium.org/issues/457351015
CVE: CVE-2025-2843
Published: 2025-11-12
Description: A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://access.redhat.com/errata/RHSA-2025:21146; https://access.redhat.com/security/cve/CVE-2025-2843; https://bugzilla.redhat.com/show_bug.cgi?id=2355222
CVE: CVE-2025-52331
Published: 2025-11-12
Description: Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MarcinB44/[PII_REDACTED]c4b34aedf682c9091b14fa; https://www.rarlab.com/rarnew.htm; https://www.win-rar.com/whatsnew.html
CVE: CVE-2025-59088
Published: 2025-11-12
Description: If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where
the "use_dns" setting is explicitly set to false are not affected.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://access.redhat.com/errata/RHSA-2025:21138; https://access.redhat.com/errata/RHSA-2025:21139; https://access.redhat.com/errata/RHSA-2025:21140
CVE: CVE-2025-59089
Published: 2025-11-12
Description: If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new
buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response
header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2025:21138; https://access.redhat.com/errata/RHSA-2025:21139; https://access.redhat.com/errata/RHSA-2025:21140
CVE: CVE-2025-59491
Published: 2025-11-12
Description: Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://centralsquare.com; https://machevalia.blog/blog/multiple-vulnerabilities-in-centralsquare-etrakit-and-ivr
CVE: CVE-2025-63419
Published: 2025-11-12
Description: Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MMAKINGDOM/39ded58b1e6d2d19366e76e0d5b1c851; https://github.com/MMAKINGDOM/CVE-2025-63419/
CVE: CVE-2025-20378
Published: 2025-11-12
Description: In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will.
CVSS Score: 3.1 (LOW)
CWE: CWE-601
References: https://advisory.splunk.com/advisories/SVD-2025-1101
CVE: CVE-2025-20379
Published: 2025-11-12
Description: In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the “/services/streams/search“ endpoint through its “q“ parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2025-1102
CVE: CVE-2025-25236
Published: 2025-11-12
Description: Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://static.omnissa.com/sites/default/files/OMSA-2025-0005.pdf; https://www.omnissa.com/omnissa-security-response/
CVE: CVE-2025-60645
Published: 2025-11-12
Description: A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/LockeTom/77fb982a49dee956101810bbefa09fb4; https://github.com/xuxueli/xxl-api/issues/64
CVE: CVE-2025-63811
Published: 2025-11-12
Description: An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/dvsekhvalnov/jose2go/issues/33
CVE: CVE-2025-65001
Published: 2025-11-12
Description: Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://hexaplex.ai; https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FCCL-2025-072319-Security-Notice.pdf; https://ydinkin.substack.com/p/200-kernel-bugs-in-30-days
CVE: CVE-2025-65002
Published: 2025-11-12
Description: Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-ISS-2025-082610-Security-Notice.pdf
CVE: CVE-2024-45301
Published: 2025-11-12
Description: Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an ntlm hash out of the victim's machine to an attacker controlled remote host. An attacker can use password cracking tools or NetNTLMv2 hashes to Pass the Hash. Version 3.7.5 fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/mintty/mintty/security/advisories/GHSA-jf4m-m6rv-p6c5
CVE: CVE-2024-47866
Published: 2025-11-12
Description: Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8; http://www.openwall.com/lists/oss-security/2025/11/11/3; https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8
CVE: CVE-2025-13057
Published: 2025-11-12
Description: A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/QingqingOK/CVE/issues/1; https://vuldb.com/?ctiid.332184; https://vuldb.com/?id.332184
CVE: CVE-2025-56385
Published: 2025-11-12
Description: A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://harmony.com; http://wellsky.com; https://machevalia.blog/blog/cve-2025-56385-wellsky-harmony-sql-injection
CVE: CVE-2025-57310
Published: 2025-11-12
Description: A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/MMAKINGDOM/a6c2c8c70145cbea4e119525651e9a8d; https://github.com/MMAKINGDOM/CVE-2025-57310
CVE: CVE-2025-57812
Published: 2025-11-12
Description: CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters versions 2.0.0 through 2.1.1, CUPS-Filters's `imagetoraster` filter has an out of bounds read/write vulnerability in the processing of TIFF image files.  While the pixel buffer is allocated with the number of pixels times a pre-calculated bytes-per-pixel value, the function which processes these pixels is called with a size of the number of pixels times 3.  When suitable inputs are passed, the bytes-per-pixel value can be set to 1 and bytes outside of the buffer bounds get processed. In order to trigger the bug, an attacker must issue a print job with a crafted TIFF file, and pass appropriate print job options to control the bytes-per-pixel value of the output format. They must choose a printer configuration under which the `imagetoraster` filter or its C-function equivalent `cfFilterImageToRaster()` gets invoked. The vulnerability exists in both CUPS-Filters 1.x and the successor library libcupsfilters (CUPS-Filters 2.x). In CUPS-Filters 2.x, the vulnerable function is `_cfImageReadTIFF() in libcupsfilters`. When this function is invoked as part of `cfFilterImageToRaster()`, the caller passes a look-up-table during whose processing the out of bounds memory access happens. In CUPS-Filters 1.x, the equivalent functions are all found in the cups-filters repository, which is not split into subprojects yet, and the vulnerable code is in `_cupsImageReadTIFF()`, which is called through `cupsImageOpen()` from the `imagetoraster` tool. A patch is available in commit b69dfacec7f176281782e2f7ac44f04bf9633cfa.
CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-787
References: https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/cupsfilters/image-tiff.c#L34; https://github.com/OpenPrinting/cups-filters/blob/3c58463e341b12c9d30d7d3807d2bac1bc595a78/filter/imagetoraster.c#L613; https://github.com/OpenPrinting/libcupsfilters/blob/33421982e10f6a14bc0bab03b80c9cf4660e8d7d/cupsfilters/image-tiff.c#L32