From bf90010201b9d9475bbc82e3c1dff97451a8a587 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 30 Apr 2026 10:44:40 -0400 Subject: [PATCH] import UBI libtiff-4.4.0-15.el9_7.3 --- SOURCES/libtiff-4.6.0-CVE-2026-4775.patch | 39 +++++++++++++++++++++++ SPECS/libtiff.spec | 8 ++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libtiff-4.6.0-CVE-2026-4775.patch diff --git a/SOURCES/libtiff-4.6.0-CVE-2026-4775.patch b/SOURCES/libtiff-4.6.0-CVE-2026-4775.patch new file mode 100644 index 0000000..6a43363 --- /dev/null +++ b/SOURCES/libtiff-4.6.0-CVE-2026-4775.patch @@ -0,0 +1,39 @@ +diff -up tiff-4.4.0/libtiff/tif_getimage.c.CVE-2026-4775 tiff-4.4.0/libtiff/tif_getimage.c +--- tiff-4.4.0/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-20 13:21:08.882223234 +0200 ++++ tiff-4.4.0/libtiff/tif_getimage.c 2026-04-20 13:21:56.640529927 +0200 +@@ -1914,7 +1914,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + uint32_t* cp1 = cp + w + toskew; + uint32_t* cp2 = cp1 + w + toskew; + uint32_t* cp3 = cp2 + w + toskew; +- int32_t incr = 3 * w + 4 * toskew; ++ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew; + + (void) y; + /* adjust fromskew */ +@@ -2018,7 +2018,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + DECLAREContigPutFunc(putcontig8bitYCbCr42tile) + { + uint32_t* cp1 = cp + w + toskew; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + + (void) y; + fromskew = (fromskew / 4) * (4*2+2); +@@ -2144,7 +2144,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4 + DECLAREContigPutFunc(putcontig8bitYCbCr22tile) + { + uint32_t* cp2; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + (void) y; + fromskew = (fromskew / 2) * (2*2+2); + cp2 = cp+w+toskew; +@@ -2239,7 +2239,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2 + DECLAREContigPutFunc(putcontig8bitYCbCr12tile) + { + uint32_t* cp2; +- int32_t incr = 2 * toskew + w; ++ const tmsize_t incr = 2 * (tmsize_t)toskew + w; + (void) y; + fromskew = (fromskew / 1) * (1 * 2 + 2); + cp2 = cp+w+toskew; diff --git a/SPECS/libtiff.spec b/SPECS/libtiff.spec index f1556ae..3843190 100644 --- a/SPECS/libtiff.spec +++ b/SPECS/libtiff.spec @@ -1,7 +1,7 @@ Summary: Library of functions for manipulating TIFF format image files Name: libtiff Version: 4.4.0 -Release: 15%{?dist}.2 +Release: 15%{?dist}.3 License: libtiff URL: http://www.simplesystems.org/libtiff/ @@ -47,6 +47,9 @@ Patch25: libtiff-4.4.0-cve2023-52355.patch Patch26: RHEL-112545.patch # CVE-2025-8176, RHEL-120239 Patch27: RHEL-120239.patch +# from upstream, for <= 4.7.1, RHEL-159330 +# https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c +Patch28: libtiff-4.6.0-CVE-2026-4775.patch BuildRequires: gcc, gcc-c++ BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel @@ -205,6 +208,9 @@ find html -name 'Makefile*' | xargs rm %{_mandir}/man1/* %changelog +* Mon Apr 20 2026 Michal Hlavinka - 4.4.0-15.3 +- fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159330) + * Mon Nov 03 2025 RHEL Packaging Agent - 4.4.0-15.2 - fix CVE-2025-8176: tiffdither and tiffmedian skip first line of input images (RHEL-120239)