{"id":"CVE-2026-36849","aliases":["BELL-CVE-2026-36849","DEBIAN-CVE-2026-36849","MGASA-2026-0246","OESA-2026-2834","OESA-2026-2835","OESA-2026-2836","OESA-2026-2837","ROOT-OS-DEBIAN-11-CVE-2026-36849","ROOT-OS-DEBIAN-12-CVE-2026-36849","ROOT-OS-DEBIAN-13-CVE-2026-36849","SUSE-SU-2026:22590-1","SUSE-SU-2026:22616-1","SUSE-SU-2026:22796-1","SUSE-SU-2026:22886-1","SUSE-SU-2026:2853-1","SUSE-SU-2026:3027-1","SUSE-SU-2026:3054-1","UBUNTU-CVE-2026-36849","openSUSE-SU-2026:11225-1","openSUSE-SU-2026:21289-1"],"status":"published","title":"Updated libtiff packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nDenial of Service via large SamplesPerPixel tag. (CVE-2026-36849)","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-17T05:48:06.30752308Z","modified":"2026-10-17T12:58:13Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"tiff","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"tiff","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tiff","fixed_in":["4.7.1-3"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libtiff","fixed_in":["4.7.2-1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libtiff","fixed_in":["4.3.0-37.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libtiff","fixed_in":["4.3.0-51.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libtiff","fixed_in":["4.6.0-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libtiff","fixed_in":["4.6.0-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"tiff","fixed_in":["4.2.0-1+deb11u8.aikido.17","4.2.0-1+deb11u8.aikido.19","4.2.0-1+deb11u8.aikido.18","4.2.0-1+deb11u8.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-tiff","fixed_in":["4.2.0-1+deb11u8.aikido.17","4.2.0-1+deb11u8.aikido.19","4.2.0-1+deb11u8.aikido.18","4.2.0-1+deb11u8.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"tiff","fixed_in":["4.5.0-6+deb12u4.aikido.20","4.5.0-6+deb12u4.aikido.21","4.5.0-6+deb12u4.aikido.22"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-tiff","fixed_in":["4.5.0-6+deb12u4.aikido.20","4.5.0-6+deb12u4.aikido.21","4.5.0-6+deb12u4.aikido.22"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"tiff","fixed_in":["4.7.0-3+deb13u3.aikido.8","4.7.0-3+deb13u3.aikido.9","4.7.0-3+deb13u3.aikido.10"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-tiff","fixed_in":["4.7.0-3+deb13u3.aikido.8","4.7.0-3+deb13u3.aikido.9","4.7.0-3+deb13u3.aikido.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-r1"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-r1"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0-6","4.5.0-6+deb12u1","4.5.0-6+deb12u2","4.5.0-6+deb12u3","4.5.0-6+deb12u4","4.5.1+git230720-1","4.5.1+git230720-2","4.5.1+git230720-3","4.5.1+git230720-4","4.5.1+git230720-5","4.5.1-1","4.5.1~rc3-1","4.6.0-1","4.6.0-2","4.7.0-1","4.7.0-2","4.7.0-3","4.7.0-4","4.7.0-5","4.7.1-1","4.7.1-2","4.7.1-3","4.7.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-3","4.7.0-3+deb13u1","4.7.0-3+deb13u2","4.7.0-3+deb13u3","4.7.0-4","4.7.0-5","4.7.1-1","4.7.1-2","4.7.1-3","4.7.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-3"}]}],"versions":["4.7.0-3","4.7.0-4","4.7.0-5","4.7.1-1","4.7.1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-37.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-51.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libtiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1+deb11u8.aikido.17"},{"fixed":"4.2.0-1+deb11u8.aikido.19"},{"fixed":"4.2.0-1+deb11u8.aikido.18"},{"fixed":"4.2.0-1+deb11u8.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1+deb11u8.aikido.17"},{"fixed":"4.2.0-1+deb11u8.aikido.19"},{"fixed":"4.2.0-1+deb11u8.aikido.18"},{"fixed":"4.2.0-1+deb11u8.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-6+deb12u4.aikido.20"},{"fixed":"4.5.0-6+deb12u4.aikido.21"},{"fixed":"4.5.0-6+deb12u4.aikido.22"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-6+deb12u4.aikido.20"},{"fixed":"4.5.0-6+deb12u4.aikido.21"},{"fixed":"4.5.0-6+deb12u4.aikido.22"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-3+deb13u3.aikido.8"},{"fixed":"4.7.0-3+deb13u3.aikido.9"},{"fixed":"4.7.0-3+deb13u3.aikido.10"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-3+deb13u3.aikido.8"},{"fixed":"4.7.0-3+deb13u3.aikido.9"},{"fixed":"4.7.0-3+deb13u3.aikido.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-slfo.1.1_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-150600.3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-150600.3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-150600.3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-150600.3.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.115.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-44.115.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-150000.45.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-3.1ubuntu4","1.9.0-3.1ubuntu6","1.10.1+dfsg-2","1.10.1+dfsg-2build1","1.10.1+dfsg-3","1.10.1+dfsg-3build1","1.10.1+dfsg-3build2","1.10.1+dfsg-3ubuntu1","1.10.1+dfsg-3ubuntu2","1.10.1+dfsg-5ubuntu1","1.10.1+dfsg-5ubuntu1+esm1","1.10.1+dfsg-5ubuntu1+esm2","1.10.1+dfsg-5ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-4ubuntu3","4.0.3-5ubuntu1","4.0.3-6","4.0.3-6ubuntu1","4.0.3-7","4.0.3-7ubuntu0.1","4.0.3-7ubuntu0.2","4.0.3-7ubuntu0.3","4.0.3-7ubuntu0.4","4.0.3-7ubuntu0.6","4.0.3-7ubuntu0.7","4.0.3-7ubuntu0.8","4.0.3-7ubuntu0.9","4.0.3-7ubuntu0.10","4.0.3-7ubuntu0.11","4.0.3-7ubuntu0.11+esm1","4.0.3-7ubuntu0.11+esm2","4.0.3-7ubuntu0.11+esm3","4.0.3-7ubuntu0.11+esm4","4.0.3-7ubuntu0.11+esm5","4.0.3-7ubuntu0.11+esm6","4.0.3-7ubuntu0.11+esm7","4.0.3-7ubuntu0.11+esm8","4.0.3-7ubuntu0.11+esm9","4.0.3-7ubuntu0.11+esm10","4.0.3-7ubuntu0.11+esm11","4.0.3-7ubuntu0.11+esm12","4.0.3-7ubuntu0.11+esm13","4.0.3-7ubuntu0.11+esm14","4.0.3-7ubuntu0.11+esm15","4.0.3-7ubuntu0.11+esm16","4.0.3-7ubuntu0.11+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-12.3ubuntu2","4.0.5-1","4.0.6-1","4.0.6-1ubuntu0.1","4.0.6-1ubuntu0.2","4.0.6-1ubuntu0.3","4.0.6-1ubuntu0.4","4.0.6-1ubuntu0.5","4.0.6-1ubuntu0.6","4.0.6-1ubuntu0.7","4.0.6-1ubuntu0.8","4.0.6-1ubuntu0.8+esm1","4.0.6-1ubuntu0.8+esm2","4.0.6-1ubuntu0.8+esm3","4.0.6-1ubuntu0.8+esm4","4.0.6-1ubuntu0.8+esm6","4.0.6-1ubuntu0.8+esm7","4.0.6-1ubuntu0.8+esm8","4.0.6-1ubuntu0.8+esm9","4.0.6-1ubuntu0.8+esm10","4.0.6-1ubuntu0.8+esm11","4.0.6-1ubuntu0.8+esm12","4.0.6-1ubuntu0.8+esm13","4.0.6-1ubuntu0.8+esm14","4.0.6-1ubuntu0.8+esm15","4.0.6-1ubuntu0.8+esm16","4.0.6-1ubuntu0.8+esm17","4.0.6-1ubuntu0.8+esm18","4.0.6-1ubuntu0.8+esm19","4.0.6-1ubuntu0.8+esm20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.2+dfsg-3ubuntu3","1.11.2+dfsg-3ubuntu4","1.11.3+dfsg-2build1","1.11.3+dfsg-2build2","1.11.3+dfsg-2build3","1.11.3+dfsg-3","1.11.3+dfsg-3build1","1.11.3+dfsg-3build2","1.11.3+dfsg-3ubuntu0.1~esm1","1.11.3+dfsg-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.8-5","4.0.8-6","4.0.9-1","4.0.9-2","4.0.9-3","4.0.9-4","4.0.9-4ubuntu1","4.0.9-5","4.0.9-5ubuntu0.1","4.0.9-5ubuntu0.2","4.0.9-5ubuntu0.3","4.0.9-5ubuntu0.4","4.0.9-5ubuntu0.5","4.0.9-5ubuntu0.6","4.0.9-5ubuntu0.7","4.0.9-5ubuntu0.8","4.0.9-5ubuntu0.9","4.0.9-5ubuntu0.10","4.0.9-5ubuntu0.10+esm1","4.0.9-5ubuntu0.10+esm2","4.0.9-5ubuntu0.10+esm3","4.0.9-5ubuntu0.10+esm4","4.0.9-5ubuntu0.10+esm5","4.0.9-5ubuntu0.10+esm6","4.0.9-5ubuntu0.10+esm7","4.0.9-5ubuntu0.10+esm8","4.0.9-5ubuntu0.10+esm9","4.0.9-5ubuntu0.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neuron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5-1","5.0.2-1","5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10+git191003-1","4.1.0+git191117-1","4.1.0+git191117-2","4.1.0+git191117-2build1","4.1.0+git191117-2ubuntu0.20.04.1","4.1.0+git191117-2ubuntu0.20.04.2","4.1.0+git191117-2ubuntu0.20.04.3","4.1.0+git191117-2ubuntu0.20.04.4","4.1.0+git191117-2ubuntu0.20.04.5","4.1.0+git191117-2ubuntu0.20.04.6","4.1.0+git191117-2ubuntu0.20.04.7","4.1.0+git191117-2ubuntu0.20.04.8","4.1.0+git191117-2ubuntu0.20.04.9","4.1.0+git191117-2ubuntu0.20.04.10","4.1.0+git191117-2ubuntu0.20.04.11","4.1.0+git191117-2ubuntu0.20.04.12","4.1.0+git191117-2ubuntu0.20.04.13","4.1.0+git191117-2ubuntu0.20.04.14","4.1.0+git191117-2ubuntu0.20.04.14+esm1","4.1.0+git191117-2ubuntu0.20.04.14+esm2","4.1.0+git191117-2ubuntu0.20.04.14+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neuron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1build2","7.6.3-1build3","7.6.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build2","5.0.3-1build3","5.0.3-1build4","5.0.3-1build5","5.0.3-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"neuron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1build5","7.6.3-1build6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0-1","4.3.0-2","4.3.0-3","4.3.0-3build1","4.3.0-4","4.3.0-5","4.3.0-6","4.3.0-6ubuntu0.1","4.3.0-6ubuntu0.2","4.3.0-6ubuntu0.3","4.3.0-6ubuntu0.4","4.3.0-6ubuntu0.5","4.3.0-6ubuntu0.6","4.3.0-6ubuntu0.7","4.3.0-6ubuntu0.8","4.3.0-6ubuntu0.9","4.3.0-6ubuntu0.10","4.3.0-6ubuntu0.11","4.3.0-6ubuntu0.12","4.3.0-6ubuntu0.13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build8","5.0.3-1build9","5.0.3-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1+git230720-1ubuntu1","4.5.1+git230720-3ubuntu1","4.5.1+git230720-4ubuntu1","4.5.1+git230720-4ubuntu2","4.5.1+git230720-4ubuntu2.1","4.5.1+git230720-4ubuntu2.2","4.5.1+git230720-4ubuntu2.3","4.5.1+git230720-4ubuntu2.4","4.5.1+git230720-4ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-1build4","5.1.3+dfsg-1build5","5.1.3+dfsg-1build6","5.1.3+dfsg-1build7","5.1.3+dfsg-1build8","5.1.3+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-3","5.1.3+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1+git230720-4ubuntu4","4.7.0-3ubuntu1","4.7.0-3ubuntu2","4.7.0-3ubuntu3","4.7.0-3ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-3ubuntu4","4.7.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-3ubuntu3","4.7.0-3ubuntu4","4.7.0-3ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tiff-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-160000.1.1"}]}],"bundled":3}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-36849","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-36849","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0246.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35718","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/17/1","tags":["web","report"]},{"url":"https://gitlab.com/libtiff/libtiff/-/work_items/781","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-36849","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2835","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2836","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2837","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622590-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268434","tags":["report"]},{"url":"https://bugzilla.suse.com/1269779","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-36849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4775","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622616-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622796-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257123","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622886-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262853-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263027-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263054-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-36849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-36849","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-2834","title":"libtiff security update","description":"This  provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Hi,\\n\\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\\nin libtiff.\\n\\n== Summary ==\\n\\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\\n\\n== Affected Versions ==\\n\\nlibtiff v4.7.1 and prior\\n\\n== Patch ==\u0026apos;, \u0026apos;== References ==\\n\\n- CVE: CVE-2026-36849\\n- Issue:\u0026apos;, \u0026apos;Regards,\\nSatriyo Utomo\\n(aleens-lab)\u0026apos;](CVE-2026-36849)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.907742753Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2835","title":"libtiff security update","description":"This  provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Hi,\\n\\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\\nin libtiff.\\n\\n== Summary ==\\n\\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\\n\\n== Affected Versions ==\\n\\nlibtiff v4.7.1 and prior\\n\\n== Patch ==\u0026apos;, \u0026apos;== References ==\\n\\n- CVE: CVE-2026-36849\\n- Issue:\u0026apos;, \u0026apos;Regards,\\nSatriyo Utomo\\n(aleens-lab)\u0026apos;](CVE-2026-36849)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.910477013Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2836","title":"libtiff security update","description":"This  provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Hi,\\n\\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\\nin libtiff.\\n\\n== Summary ==\\n\\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\\n\\n== Affected Versions ==\\n\\nlibtiff v4.7.1 and prior\\n\\n== Patch ==\u0026apos;, \u0026apos;== References ==\\n\\n- CVE: CVE-2026-36849\\n- Issue:\u0026apos;, \u0026apos;Regards,\\nSatriyo Utomo\\n(aleens-lab)\u0026apos;](CVE-2026-36849)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.036720976Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2837","title":"libtiff security update","description":"This  provides support for the Tag Image File Format (TIFF), a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff library.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Hi,\\n\\nI would like to disclose CVE-2026-36849, a denial of service vulnerability\\nin libtiff.\\n\\n== Summary ==\\n\\nAn issue in libtiff v4.7.1 allows an attacker to cause a denial of service\\nvia a crafted TIFF file containing a large SamplesPerPixel tag value.\\n\\n== Affected Versions ==\\n\\nlibtiff v4.7.1 and prior\\n\\n== Patch ==\u0026apos;, \u0026apos;== References ==\\n\\n- CVE: CVE-2026-36849\\n- Issue:\u0026apos;, \u0026apos;Regards,\\nSatriyo Utomo\\n(aleens-lab)\u0026apos;](CVE-2026-36849)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.051781344Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"BELL-CVE-2026-36849","status":"published","published":"2026-06-19T06:12:41.972043Z","modified":"2026-09-06T07:15:24.449091964Z","updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"DEBIAN-CVE-2026-36849","status":"published","published":"2026-06-17T05:48:06.30752308Z","modified":"2026-09-01T15:06:02.911184364Z","updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"MGASA-2026-0246","title":"Updated libtiff packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nDenial of Service via large SamplesPerPixel tag. (CVE-2026-36849)\n","status":"published","published":"2026-07-13T21:24:46Z","modified":"2026-07-13T21:30:05.967537504Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11225-1","title":"libtiff-devel-32bit-4.7.2-1.1 on GA media","description":"These are all security issues fixed in the libtiff-devel-32bit-4.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:08.540600021Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21289-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nChanges for tiff:\n\n- Update to 4.7.2:\n\n Software configuration changes:\n\n * cmake: Fix bundle identifiers to use reverse-DNS format\n * cmake: Fix and improve Apple framework build support\n * cmake: Use TurboJPEG CONFIG by default (issue #767)\n * cmake: changes related to 8-/12-bit modes\n * cmake: Replace CMath::CMath with direct link to avoid export.\n * Support for iOS-derived builds\n * Simplify cmake byte order version check\n * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n * configure.ac: Require bootstrap with at least Autoconf 2.71.\n\n Bug fixes:\n\n * Handle negative TIFFReadFile results before state updates (issue #854)\n * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n * tif_print.c: add integer overflow checks to allocation size calculations\n * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n * DumpModeSeek: add bounds check to prevent OOB pointer advance\n * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.\n * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)\n * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n * TIFFLinkDirectory() checks for IFD loops (issue #788)\n * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)\n * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)\n * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)\n * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n * PixarLog: error out on invalid ABGR output buffer sizes.\n * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)\n * OJPEG: fix integer overflow in subsampling buffer allocation.\n * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n * fix null pointer deference in issue #782.\n * fix stack-overflow in issue #784.\n\n Other changes:\n\n * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n * Harden integer size and offset calculations (issue #897)\n * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n * Move widening casts inside multiplication scope.\n * Lots of compiler warning fixes related to enabling more warning flags\n * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-10T08:42:03Z","modified":"2026-07-13T18:24:57.14303309Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-36849","title":"CVE-2026-36849 in tiff - Patched by Root","description":"Root has patched CVE-2026-36849 in the tiff package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-02T13:00:50Z","modified":"2026-09-02T16:15:02.940041001Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-36849","title":"CVE-2026-36849 in tiff - Patched by Root","description":"Root has patched CVE-2026-36849 in the tiff package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:45:33Z","modified":"2026-09-02T14:00:05.417921262Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-36849","title":"CVE-2026-36849 in tiff - Patched by Root","description":"Root has patched CVE-2026-36849 in the tiff package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-03T07:42:25Z","modified":"2026-09-03T09:15:02.071701337Z","updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"SUSE-SU-2026:22590-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nChanges for tiff:\n\n- Update to 4.7.2:\n\n Software configuration changes:\n\n * cmake: Fix bundle identifiers to use reverse-DNS format\n * cmake: Fix and improve Apple framework build support\n * cmake: Use TurboJPEG CONFIG by default (issue #767)\n * cmake: changes related to 8-/12-bit modes\n * cmake: Replace CMath::CMath with direct link to avoid export.\n * Support for iOS-derived builds\n * Simplify cmake byte order version check\n * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n * configure.ac: Require bootstrap with at least Autoconf 2.71.\n\n Bug fixes:\n\n * Handle negative TIFFReadFile results before state updates (issue #854)\n * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n * tif_print.c: add integer overflow checks to allocation size calculations\n * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n * DumpModeSeek: add bounds check to prevent OOB pointer advance\n * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.\n * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)\n * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n * TIFFLinkDirectory() checks for IFD loops (issue #788)\n * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)\n * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)\n * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)\n * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n * PixarLog: error out on invalid ABGR output buffer sizes.\n * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)\n * OJPEG: fix integer overflow in subsampling buffer allocation.\n * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n * fix null pointer deference in issue #782.\n * fix stack-overflow in issue #784.\n\n Other changes:\n\n * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n * Harden integer size and offset calculations (issue #897)\n * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n * Move widening casts inside multiplication scope.\n * Lots of compiler warning fixes related to enabling more warning flags\n * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-10T08:42:17Z","modified":"2026-07-16T18:24:37.780027407Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22616-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nChanges for tiff:\n\n- Update to 4.7.2:\n\n Software configuration changes:\n\n * cmake: Fix bundle identifiers to use reverse-DNS format\n * cmake: Fix and improve Apple framework build support\n * cmake: Use TurboJPEG CONFIG by default (issue #767)\n * cmake: changes related to 8-/12-bit modes\n * cmake: Replace CMath::CMath with direct link to avoid export.\n * Support for iOS-derived builds\n * Simplify cmake byte order version check\n * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n * configure.ac: Require bootstrap with at least Autoconf 2.71.\n\n Bug fixes:\n\n * Handle negative TIFFReadFile results before state updates (issue #854)\n * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n * tif_print.c: add integer overflow checks to allocation size calculations\n * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n * DumpModeSeek: add bounds check to prevent OOB pointer advance\n * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before accessing it.\n * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling block to prevent out-of-bounds writes. (issue #753)\n * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n * TIFFLinkDirectory() checks for IFD loops (issue #788)\n * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values (https://github.com/OSGeo/gdal/issues/13465)\n * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode (https://issues.oss-fuzz.com/issues/471328917)\n * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory disclosure (issue #826)\n * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n * PixarLog: error out on invalid ABGR output buffer sizes.\n * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds (https://issues.oss-fuzz.com/issues/506737072)\n * OJPEG: fix integer overflow in subsampling buffer allocation.\n * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n * fix null pointer deference in issue #782.\n * fix stack-overflow in issue #784.\n\n Other changes:\n\n * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n * Harden integer size and offset calculations (issue #897)\n * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n * Move widening casts inside multiplication scope.\n * Lots of compiler warning fixes related to enabling more warning flags\n * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-10T08:42:17Z","modified":"2026-07-17T18:24:02.37211771Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22796-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nUpdate to version 4.7.2.\n\nSecurity issues fixed:\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nOther updates and bugfixes:\n\n- Enable Lerc support in openSUSE (bsc#1257123).\n- Version 4.7.2:\n  - Software configuration changes:\n    * cmake: Fix bundle identifiers to use reverse-DNS format\n    * cmake: Fix and improve Apple framework build support\n    * cmake: Use TurboJPEG CONFIG by default (issue #767)\n    * cmake: changes related to 8-/12-bit modes\n    * cmake: Replace CMath::CMath with direct link to avoid export.\n    * Support for iOS-derived builds\n    * Simplify cmake byte order version check\n    * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n    * configure.ac: Require bootstrap with at least Autoconf 2.71.\n  - Library changes:\n    * New/improved functionalities::\n    + Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)\n  - Bug fixes:\n    * Handle negative TIFFReadFile results before state updates (issue #854)\n    * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n    * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n    * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n    * tif_print.c: add integer overflow checks to allocation size calculations\n    * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n    * DumpModeSeek: add bounds check to prevent OOB pointer advance\n    * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n    * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before\n      accessing it.\n    * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n    * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n    * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n    * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n    * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling\n      block to prevent out-of-bounds writes. (issue #753)\n    * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)\n    * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n    * TIFFLinkDirectory() checks for IFD loops (issue #788)\n    * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n    * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n    * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values\n      (https://github.com/OSGeo/gdal/issues/13465)\n    * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n    * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n    * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n    * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode\n      (https://issues.oss-fuzz.com/issues/471328917)\n    * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n    * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n    * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n    * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n    * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory\n      disclosure (issue #826)\n    * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n    * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n    * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n    * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n    * PixarLog: error out on invalid ABGR output buffer sizes.\n    * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n    * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)\n    * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n    * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n    * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds\n      (https://issues.oss-fuzz.com/issues/506737072)\n    * OJPEG: fix integer overflow in subsampling buffer allocation.\n    * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n    * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n    * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n    * fix null pointer deference in issue #782.\n    * fix stack-overflow in issue #784.\n  - Other changes:\n    * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n    * Harden integer size and offset calculations (issue #897)\n    * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n    * Move widening casts inside multiplication scope.\n    * Lots of compiler warning fixes related to enabling more warning flags\n    * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n    * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-17T12:18:16Z","modified":"2026-07-28T18:24:05.291380049Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22886-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\nUpdate to version 4.7.2.\n\nSecurity issues fixed:\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nOther updates and bugfixes:\n\n- Enable Lerc support in openSUSE (bsc#1257123).\n- Version 4.7.2:\n  - Software configuration changes:\n    * cmake: Fix bundle identifiers to use reverse-DNS format\n    * cmake: Fix and improve Apple framework build support\n    * cmake: Use TurboJPEG CONFIG by default (issue #767)\n    * cmake: changes related to 8-/12-bit modes\n    * cmake: Replace CMath::CMath with direct link to avoid export.\n    * Support for iOS-derived builds\n    * Simplify cmake byte order version check\n    * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n    * configure.ac: Require bootstrap with at least Autoconf 2.71.\n  - Library changes:\n    * New/improved functionalities::\n    + Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)\n  - Bug fixes:\n    * Handle negative TIFFReadFile results before state updates (issue #854)\n    * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n    * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n    * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n    * tif_print.c: add integer overflow checks to allocation size calculations\n    * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n    * DumpModeSeek: add bounds check to prevent OOB pointer advance\n    * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n    * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before\n      accessing it.\n    * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n    * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n    * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n    * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n    * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling\n      block to prevent out-of-bounds writes. (issue #753)\n    * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)\n    * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n    * TIFFLinkDirectory() checks for IFD loops (issue #788)\n    * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n    * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n    * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values\n      (https://github.com/OSGeo/gdal/issues/13465)\n    * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n    * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n    * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n    * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode\n      (https://issues.oss-fuzz.com/issues/471328917)\n    * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n    * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n    * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n    * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n    * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory\n      disclosure (issue #826)\n    * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n    * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n    * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n    * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n    * PixarLog: error out on invalid ABGR output buffer sizes.\n    * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n    * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)\n    * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n    * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n    * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds\n      (https://issues.oss-fuzz.com/issues/506737072)\n    * OJPEG: fix integer overflow in subsampling buffer allocation.\n    * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n    * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n    * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n    * fix null pointer deference in issue #782.\n    * fix stack-overflow in issue #784.\n  - Other changes:\n    * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n    * Harden integer size and offset calculations (issue #897)\n    * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n    * Move widening casts inside multiplication scope.\n    * Lots of compiler warning fixes related to enabling more warning flags\n    * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n    * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-21T16:29:11Z","modified":"2026-07-28T18:24:13.660682806Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2853-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues:\n\nUpdate to version 4.7.2.\n\nSecurity issues fixed:\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n\nOther updates and bugfixes:\n\n- Version 4.7.2:\n  - Software configuration changes:\n    * cmake: Fix bundle identifiers to use reverse-DNS format\n    * cmake: Fix and improve Apple framework build support\n    * cmake: Use TurboJPEG CONFIG by default (issue #767)\n    * cmake: changes related to 8-/12-bit modes\n    * cmake: Replace CMath::CMath with direct link to avoid export.\n    * Support for iOS-derived builds\n    * Simplify cmake byte order version check\n    * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions\n    * configure.ac: Require bootstrap with at least Autoconf 2.71.\n  - Library changes:\n    * New/improved functionalities::\n    + Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)\n  - Bug fixes:\n    * Handle negative TIFFReadFile results before state updates (issue #854)\n    * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip\n    * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)\n    * tif_dirwrite.c: add integer overflow checks to allocation size calculations\n    * tif_print.c: add integer overflow checks to allocation size calculations\n    * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop\n    * DumpModeSeek: add bounds check to prevent OOB pointer advance\n    * TIFFGrowStrips: fix use-after-free on partial realloc failure.\n    * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before\n      accessing it.\n    * TIFFRGBAImage: avoid int overflows in put functions (issue #830)\n    * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)\n    * tif_getimage: Widen pointer-offset arithmetic in tif_getimage\n    * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)\n    * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling\n      block to prevent out-of-bounds writes. (issue #753)\n    * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)\n    * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)\n    * TIFFLinkDirectory() checks for IFD loops (issue #788)\n    * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.\n    * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)\n    * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values\n      (https://github.com/OSGeo/gdal/issues/13465)\n    * tif_getimage: reject tile widths that would overflow toskew (issue #808)\n    * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.\n    * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).\n    * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode\n      (https://issues.oss-fuzz.com/issues/471328917)\n    * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode\n    * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).\n    * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)\n    * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)\n    * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory\n      disclosure (issue #826)\n    * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)\n    * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)\n    * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow\n    * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)\n    * PixarLog: error out on invalid ABGR output buffer sizes.\n    * PixarLog: complete ABGR bounds check for multi-row strip decoding.\n    * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)\n    * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).\n    * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)\n    * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds\n      (https://issues.oss-fuzz.com/issues/506737072)\n    * OJPEG: fix integer overflow in subsampling buffer allocation.\n    * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).\n    * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).\n    * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)\n    * fix null pointer deference in issue #782.\n    * fix stack-overflow in issue #784.\n  - Other changes:\n    * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).\n    * Harden integer size and offset calculations (issue #897)\n    * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication\n    * Move widening casts inside multiplication scope.\n    * Lots of compiler warning fixes related to enabling more warning flags\n    * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)\n    * TIFFFillStrip(): prevent harmless unsigned integer overflow\n","status":"published","published":"2026-07-10T17:54:44Z","modified":"2026-07-13T18:24:55.720580465Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3027-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n","status":"published","published":"2026-07-15T09:49:55Z","modified":"2026-07-16T10:00:06.729593578Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3054-1","title":"Security update for tiff","description":"This update for tiff fixes the following issues\n\n- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).\n- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value\n  (bsc#1268434).\n","status":"published","published":"2026-07-15T13:21:45Z","modified":"2026-07-16T10:00:15.022543229Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"UBUNTU-CVE-2026-36849","description":"[Denial of Service via large SamplesPerPixel tag]","status":"published","published":"2026-06-18T00:00:00Z","modified":"2026-10-17T12:58:13.72270591Z","updated_at":"2026-11-02T16:56:16.686388Z"}]}}