LibTIFF 3.9.3 3.9.4 3.9.5 3.9.6 3.9.7 4.0.0alpha4 4.0.0alpha5 4.0.0alpha6 4.0.0beta7 4.0.0 4.0.1 4.0.2 4.0.3 4.0.4 4.0.4beta 4.0.5 4.0.6 4.0.7 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer ignoring the buffer size which leads to a tif_jbig.c JBIGDecode out-of-bounds write.