tiff: version bump to address open CVEs