SUSE-SU-2026:22590-1: important: Security update for tiff
SLE-UPDATES
null at suse.de
Wed Jul 15 16:32:55 UTC 2026
# Security update for tiff
Announcement ID: SUSE-SU-2026:22590-1
Release Date: 2026-07-10T08:49:41Z
Rating: important
References:
* bsc#1268434
* bsc#1269779
Cross-References:
* CVE-2026-12912
* CVE-2026-36849
* CVE-2026-4775
CVSS scores:
* CVE-2026-12912 ( SUSE ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-12912 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-12912 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-36849 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-4775 ( SUSE ): 8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4775 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
* CVE-2026-4775 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-4775 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Micro 6.2
An update that solves three vulnerabilities can now be installed.
## Description:
This update for tiff fixes the following issues
* CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-
compressed TIFF image (bsc#1269779).
* CVE-2026-36849: denial of service when processing a a crafted TIFF file
containing a large SamplesPerPixel tag value (bsc#1268434).
Changes for tiff:
* Update to 4.7.2:
Software configuration changes:
* cmake: Fix bundle identifiers to use reverse-DNS format
* cmake: Fix and improve Apple framework build support
* cmake: Use TurboJPEG CONFIG by default (issue #767)
* cmake: changes related to 8-/12-bit modes
* cmake: Replace CMath::CMath with direct link to avoid export.
* Support for iOS-derived builds
* Simplify cmake byte order version check
* Add additional warnings, primarily floating precision conversions and
integer arithmetic conversions
* configure.ac: Require bootstrap with at least Autoconf 2.71.
Bug fixes:
* Handle negative TIFFReadFile results before state updates (issue #854)
* tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
* tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
* tif_dirwrite.c: add integer overflow checks to allocation size calculations
* tif_print.c: add integer overflow checks to allocation size calculations
* tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
* DumpModeSeek: add bounds check to prevent OOB pointer advance
* TIFFGrowStrips: fix use-after-free on partial realloc failure.
* Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating
the strip bytecount array before accessing it.
* TIFFRGBAImage: avoid int overflows in put functions (issue #830)
* tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue
#792)
* tif_getimage: Widen pointer-offset arithmetic in tif_getimage
* putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
* putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image
dimensions are smaller than the subsampling block to prevent out-of-bounds
writes. (issue #753)
* TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
* TIFFLinkDirectory() checks for IFD loops (issue #788)
* Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation
fault when reallocation fails.
* TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate
td_samplesperpixel==3 (issue #805)
* TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not
having 1 or SamplesPerPixel values
(https://github.com/OSGeo/gdal/issues/13465)
* tif_getimage: reject tile widths that would overflow toskew (issue #808)
* Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
* TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing
(issue #777).
* _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted
files when file opened in 'O' mode (https://issues.oss-
fuzz.com/issues/471328917)
* TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
* _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
* Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before
(re-)writing to file. (issue #749)
* JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized
memory (issue #892)
* JPEG decompressor: initialize output buffer when JPEG image is smaller than
strile dimension to avoid heap memory disclosure (issue #826)
* JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-
turbo 3.0.3 (issue #773)
* JPEGDecode(): fix memory leak in error code path (https://issues.oss-
fuzz.com/issues/471945501)
* tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
* Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
* PixarLog: error out on invalid ABGR output buffer sizes.
* PixarLog: complete ABGR bounds check for multi-row strip decoding.
* PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and
4 (issue #789).
* PixarLog codec: fix potential integer overflow/out-of-bounds access (issue
#797)
* TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap
code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)
* OJPEG: fix integer overflow in subsampling buffer allocation.
* OJPEG: fix nullptr deref when changing compression method from OJPEG to
something else (issue #795).
* OJPEG fix potential integer overflow/out-of-bounds access (issue #796).
* ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)
* fix null pointer deference in issue #782.
* fix stack-overflow in issue #784.
Other changes:
* Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification
(issue #739).
* Harden integer size and offset calculations (issue #897)
* TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication
* Move widening casts inside multiplication scope.
* Lots of compiler warning fixes related to enabling more warning flags
* Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)
* TIFFFillStrip(): prevent harmless unsigned integer overflow
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.2
zypper in -t patch SUSE-SL-Micro-6.2-1200=1
## Package List:
* SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
* tiff-debugsource-4.7.2-160000.1.1
* libtiff6-4.7.2-160000.1.1
* libtiff6-debuginfo-4.7.2-160000.1.1
* tiff-debuginfo-4.7.2-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-12912.html
* https://www.suse.com/security/cve/CVE-2026-36849.html
* https://www.suse.com/security/cve/CVE-2026-4775.html
* https://bugzilla.suse.com/show_bug.cgi?id=1268434
* https://bugzilla.suse.com/show_bug.cgi?id=1269779
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260715/6315a610/attachment.htm>
More information about the sle-updates
mailing list