Libtiff 4.0.9 has been released. According to the email announcing it:
A great many security improvements have been implemented by Even Rouault.
Much thanks to OSS Fuzz, team OWL337, Roger Leigh, and of course Even Rouault.
Obligatory reminder: Don’t download from libtiff dot org. It’s many years out of date.