SUSE-SU-2026:2853-1: important: Security update for tiff

# Security update for tiff

Announcement ID: SUSE-SU-2026:2853-1  
Release Date: 2026-07-10T17:54:45Z  
Rating: important  
References:

  * bsc#1268434
  * bsc#1269779

  
Cross-References:

  * CVE-2026-12912
  * CVE-2026-36849
  * CVE-2026-4775

  
CVSS scores:

  * CVE-2026-12912 ( SUSE ):  7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-12912 ( NVD ):  7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-12912 ( NVD ):  7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-36849 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-4775 ( SUSE ):  8.8
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-4775 ( SUSE ):  8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  * CVE-2026-4775 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-4775 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  
Affected Products:

  * Basesystem Module 15-SP7
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7
  * SUSE Package Hub 15 15-SP7

  
  
An update that solves three vulnerabilities can now be installed.

## Description:

This update for tiff fixes the following issues:

Update to version 4.7.2.

Security issues fixed:

  * CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-
    compressed TIFF image (bsc#1269779).
  * CVE-2026-36849: denial of service when processing a a crafted TIFF file
    containing a large SamplesPerPixel tag value (bsc#1268434).

Other updates and bugfixes:

  * Version 4.7.2:
  * Software configuration changes:
    * cmake: Fix bundle identifiers to use reverse-DNS format
    * cmake: Fix and improve Apple framework build support
    * cmake: Use TurboJPEG CONFIG by default (issue #767)
    * cmake: changes related to 8-/12-bit modes
    * cmake: Replace CMath::CMath with direct link to avoid export.
    * Support for iOS-derived builds
    * Simplify cmake byte order version check
    * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
    * configure.ac: Require bootstrap with at least Autoconf 2.71.
  * Library changes:
    * New/improved functionalities::
    * Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
  * Bug fixes:
    * Handle negative TIFFReadFile results before state updates (issue #854)
    * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
    * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
    * tif_dirwrite.c: add integer overflow checks to allocation size calculations
    * tif_print.c: add integer overflow checks to allocation size calculations
    * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
    * DumpModeSeek: add bounds check to prevent OOB pointer advance
    * TIFFGrowStrips: fix use-after-free on partial realloc failure.
    * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.
    * TIFFRGBAImage: avoid int overflows in put functions (issue #830)
    * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
    * tif_getimage: Widen pointer-offset arithmetic in tif_getimage
    * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
    * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)
    * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
    * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
    * TIFFLinkDirectory() checks for IFD loops (issue #788)
    * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
    * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
    * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)
    * tif_getimage: reject tile widths that would overflow toskew (issue #808)
    * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
    * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
    * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)
    * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
    * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
    * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
    * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
    * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)
    * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
    * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
    * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
    * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
    * PixarLog: error out on invalid ABGR output buffer sizes.
    * PixarLog: complete ABGR bounds check for multi-row strip decoding.
    * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)
    * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).
    * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)
    * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)
    * OJPEG: fix integer overflow in subsampling buffer allocation.
    * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).
    * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).
    * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)
    * fix null pointer deference in issue #782.
    * fix stack-overflow in issue #784.
  * Other changes:
    * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).
    * Harden integer size and offset calculations (issue #897)
    * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication
    * Move widening casts inside multiplication scope.
    * Lots of compiler warning fixes related to enabling more warning flags
    * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)
    * TIFFFillStrip(): prevent harmless unsigned integer overflow

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Package Hub 15 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2853=1

  * Basesystem Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2853=1

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2853=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2853=1

  * openSUSE Leap 15.6  
    zypper in -t patch SUSE-2026-2853=1

## Package List:

  * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
    * libtiff6-4.7.2-150600.3.29.1
    * libtiff6-debuginfo-4.7.2-150600.3.29.1
    * libtiff-devel-4.7.2-150600.3.29.1
    * tiff-debugsource-4.7.2-150600.3.29.1
    * tiff-debuginfo-4.7.2-150600.3.29.1
  * SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
    * libtiff6-32bit-4.7.2-150600.3.29.1
    * libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
    * libtiff6-4.7.2-150600.3.29.1
    * libtiff6-debuginfo-4.7.2-150600.3.29.1
    * libtiff-devel-4.7.2-150600.3.29.1
    * tiff-debugsource-4.7.2-150600.3.29.1
    * tiff-debuginfo-4.7.2-150600.3.29.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
    * libtiff6-32bit-4.7.2-150600.3.29.1
    * libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
  * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
    * libtiff6-4.7.2-150600.3.29.1
    * libtiff6-debuginfo-4.7.2-150600.3.29.1
    * libtiff-devel-4.7.2-150600.3.29.1
    * tiff-debugsource-4.7.2-150600.3.29.1
    * tiff-debuginfo-4.7.2-150600.3.29.1
  * Basesystem Module 15-SP7 (x86_64)
    * libtiff6-32bit-4.7.2-150600.3.29.1
    * libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
  * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
    * tiff-4.7.2-150600.3.29.1
    * tiff-debugsource-4.7.2-150600.3.29.1
    * tiff-debuginfo-4.7.2-150600.3.29.1
  * openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
    * libtiff6-4.7.2-150600.3.29.1
    * libtiff6-debuginfo-4.7.2-150600.3.29.1
    * libtiff-devel-4.7.2-150600.3.29.1
    * tiff-4.7.2-150600.3.29.1
    * tiff-debugsource-4.7.2-150600.3.29.1
    * tiff-debuginfo-4.7.2-150600.3.29.1
  * openSUSE Leap 15.6 (x86_64)
    * libtiff6-32bit-4.7.2-150600.3.29.1
    * libtiff-devel-32bit-4.7.2-150600.3.29.1
    * libtiff6-32bit-debuginfo-4.7.2-150600.3.29.1
  * openSUSE Leap 15.6 (aarch64_ilp32)
    * libtiff6-64bit-4.7.2-150600.3.29.1
    * libtiff6-64bit-debuginfo-4.7.2-150600.3.29.1
    * libtiff-devel-64bit-4.7.2-150600.3.29.1
  * openSUSE Leap 15.6 (noarch)
    * tiff-docs-4.7.2-150600.3.29.1
    * libtiff-devel-docs-4.7.2-150600.3.29.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-12912.html
  * https://www.suse.com/security/cve/CVE-2026-36849.html
  * https://www.suse.com/security/cve/CVE-2026-4775.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1268434
  * https://bugzilla.suse.com/show_bug.cgi?id=1269779