From 9c9f2f8ce916ae50aa24f59a259ec28ada743c4a Mon Sep 17 00:00:00 2001 From: Michal Hlavinka Date: Mon, 20 Apr 2026 13:46:57 +0200 Subject: [PATCH] fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331) Resolves: RHEL-159331 --- libtiff-4.6.0-CVE-2026-4775.patch | 39 +++++++++++++++++++++++++++++++ libtiff.spec | 8 ++++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 libtiff-4.6.0-CVE-2026-4775.patch diff --git a/libtiff-4.6.0-CVE-2026-4775.patch b/libtiff-4.6.0-CVE-2026-4775.patch new file mode 100644 index 0000000..6a43363 --- /dev/null +++ b/libtiff-4.6.0-CVE-2026-4775.patch @@ -0,0 +1,39 @@ +diff -up tiff-4.4.0/libtiff/tif_getimage.c.CVE-2026-4775 tiff-4.4.0/libtiff/tif_getimage.c +--- tiff-4.4.0/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-20 13:21:08.882223234 +0200 ++++ tiff-4.4.0/libtiff/tif_getimage.c 2026-04-20 13:21:56.640529927 +0200 +@@ -1914,7 +1914,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + uint32_t* cp1 = cp + w + toskew; + uint32_t* cp2 = cp1 + w + toskew; + uint32_t* cp3 = cp2 + w + toskew; +- int32_t incr = 3 * w + 4 * toskew; ++ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew; + + (void) y; + /* adjust fromskew */ +@@ -2018,7 +2018,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + DECLAREContigPutFunc(putcontig8bitYCbCr42tile) + { + uint32_t* cp1 = cp + w + toskew; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + + (void) y; + fromskew = (fromskew / 4) * (4*2+2); +@@ -2144,7 +2144,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + DECLAREContigPutFunc(putcontig8bitYCbCr22tile) + { + uint32_t* cp2; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + (void) y; + fromskew = (fromskew / 2) * (2*2+2); + cp2 = cp+w+toskew; +@@ -2239,7 +2239,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2 + DECLAREContigPutFunc(putcontig8bitYCbCr12tile) + { + uint32_t* cp2; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + (void) y; + fromskew = (fromskew / 1) * (1 * 2 + 2); + cp2 = cp+w+toskew; diff --git a/libtiff.spec b/libtiff.spec index a903503..09f5262 100644 --- a/libtiff.spec +++ b/libtiff.spec @@ -1,7 +1,7 @@ Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.4.0 -Release: 16%{?dist} +Release: 17%{?dist} License: libtiff URL: http://www.simplesystems.org/libtiff/ @@ -49,6 +49,9 @@ Patch26: libtiff-4.4.0-cve-2025-9900.patch # frin upstream, for < 4.7.1, RHEL-120238 # https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172 Patch27: libtiff-4.4.0-cve-2025-8176.patch +# from upstream, for <= 4.7.1, RHEL-159331 +# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c +Patch28: libtiff-4.6.0-CVE-2026-4775.patch BuildRequires: gcc, gcc-c++ BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel @@ -207,6 +210,9 @@ find html -name 'Makefile*' | xargs rm %{_mandir}/man1/* %changelog +* Thu May 07 2026 Michal Hlavinka - 4.4.0-15.3 +- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331) + * Sun Jan 18 2026 Michal Hlavinka - 4.4.0-16 - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543) - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238)