SUSE-SU-2026:2853-1: important: Security update for tiff
SLE-UPDATES
null at suse.de
Mon Jul 13 08:33:33 UTC 2026
# Security update for tiff
Announcement ID: SUSE-SU-2026:2853-1
Release Date: 2026-07-10T17:54:45Z
Rating: important
References:
* bsc#1268434
* bsc#1269779
Cross-References:
* CVE-2026-12912
* CVE-2026-36849
* CVE-2026-4775
CVSS scores:
* CVE-2026-12912 ( SUSE ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-12912 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-12912 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-36849 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-4775 ( SUSE ): 8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4775 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
* CVE-2026-4775 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4775 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
* Basesystem Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves three vulnerabilities can now be installed.
## Description:
This update for tiff fixes the following issues:
Update to version 4.7.2.
Security issues fixed:
* CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-
compressed TIFF image (bsc#1269779).
* CVE-2026-36849: denial of service when processing a a crafted TIFF file
containing a large SamplesPerPixel tag value (bsc#1268434).
Other updates and bugfixes:
* Version 4.7.2:
* Software configuration changes:
* cmake: Fix bundle identifiers to use reverse-DNS format
* cmake: Fix and improve Apple framework build support
* cmake: Use TurboJPEG CONFIG by default (issue #767)
* cmake: changes related to 8-/12-bit modes
* cmake: Replace CMath::CMath with direct link to avoid export.
* Support for iOS-derived builds
* Simplify cmake byte order version check
* Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
* configure.ac: Require bootstrap with at least Autoconf 2.71.
* Library changes:
* New/improved functionalities::
* Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
* Bug fixes:
* Handle negative TIFFReadFile results before state updates (issue #854)
* tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
* tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
* tif_dirwrite.c: add integer overflow checks to allocation size calculations
* tif_print.c: add integer overflow checks to allocation size calculations
* tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
* DumpModeSeek: add bounds check to prevent OOB pointer advance
* TIFFGrowStrips: fix use-after-free on partial realloc failure.
* Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
* TIFFRGBAImage: avoid int overflows in put functions (issue #830)
* tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
* tif_getimage: Widen pointer-offset arithmetic in tif_getimage
* putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
* putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
* TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
* TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
* TIFFLinkDirectory() checks for IFD loops (issue #788)
* Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
* TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
* TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
* tif_getimage: reject tile widths that would overflow toskew (issue #808)
* Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
* TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
* _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
* TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
* _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
* Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
* JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
* JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
* JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
* JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
* tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
* Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
* PixarLog: error out on invalid ABGR output buffer sizes.
* PixarLog: complete ABGR bounds check for multi-row strip decoding.
* PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)
* PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).
* PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)
* TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)
* OJPEG: fix integer overflow in subsampling buffer allocation.
* OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).
* OJPEG fix potential integer overflow/out-of-bounds access (issue #796).
* ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)
* fix null pointer deference in issue #782.
* fix stack-overflow in issue #784.
* Other changes:
* Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).
* Harden integer size and offset calculations (issue #897)
* TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication
* Move widening casts inside multiplication scope.
* Lots of compiler warning fixes related to enabling more warning flags
* Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)
* TIFFFillStrip(): prevent harmless unsigned integer overflow
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2853=1
* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2853=1
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2853=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2853=1
* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-2853=1
## Package List:
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* libtiff6-4.7.2-150600.3.29.1
* libtiff6-debuginfo-4.7.2-150600.3.29.1
* libtiff-devel-4.7.2-150600.3.29.1
* tiff-debugsource-4.7.2-150600.3.29.1
* tiff-debuginfo-4.7.2-150600.3.29.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
* libtiff6-32bit-4.7.2-150600.3.29.1
* libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* libtiff6-4.7.2-150600.3.29.1
* libtiff6-debuginfo-4.7.2-150600.3.29.1
* libtiff-devel-4.7.2-150600.3.29.1
* tiff-debugsource-4.7.2-150600.3.29.1
* tiff-debuginfo-4.7.2-150600.3.29.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
* libtiff6-32bit-4.7.2-150600.3.29.1
* libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* libtiff6-4.7.2-150600.3.29.1
* libtiff6-debuginfo-4.7.2-150600.3.29.1
* libtiff-devel-4.7.2-150600.3.29.1
* tiff-debugsource-4.7.2-150600.3.29.1
* tiff-debuginfo-4.7.2-150600.3.29.1
* Basesystem Module 15-SP7 (x86_64)
* libtiff6-32bit-4.7.2-150600.3.29.1
* libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* tiff-4.7.2-150600.3.29.1
* tiff-debugsource-4.7.2-150600.3.29.1
* tiff-debuginfo-4.7.2-150600.3.29.1
* openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
* libtiff6-4.7.2-150600.3.29.1
* libtiff6-debuginfo-4.7.2-150600.3.29.1
* libtiff-devel-4.7.2-150600.3.29.1
* tiff-4.7.2-150600.3.29.1
* tiff-debugsource-4.7.2-150600.3.29.1
* tiff-debuginfo-4.7.2-150600.3.29.1
* openSUSE Leap 15.6 (x86_64)
* libtiff6-32bit-4.7.2-150600.3.29.1
* libtiff-devel-32bit-4.7.2-150600.3.29.1
* libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libtiff6-64bit-4.7.2-150600.3.29.1
* libtiff6-64bit-debuginfo-4.7.2-150600.3.29.1
* libtiff-devel-64bit-4.7.2-150600.3.29.1
* openSUSE Leap 15.6 (noarch)
* tiff-docs-4.7.2-150600.3.29.1
* libtiff-devel-docs-4.7.2-150600.3.29.1
## References:
* https://www.suse.com/security/cve/CVE-2026-12912.html
* https://www.suse.com/security/cve/CVE-2026-36849.html
* https://www.suse.com/security/cve/CVE-2026-4775.html
* https://bugzilla.suse.com/show_bug.cgi?id=1268434
* https://bugzilla.suse.com/show_bug.cgi?id=1269779
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260713/1fab28de/attachment.htm>
More information about the sle-updates
mailing list