diff --git a/SPECS/libtiff/CVE-2025-8176.patch b/SPECS/libtiff/CVE-2025-8176.patch new file mode 100644 index 00000000000..1a625c041de --- /dev/null +++ b/SPECS/libtiff/CVE-2025-8176.patch @@ -0,0 +1,25 @@ +From 10032ccd085e2c8cd1b6905c2bce56789ab39165 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Sat, 24 May 2025 21:38:09 -0700 +Subject: [PATCH] conflict resolution + +--- + archive/tools/tiffmedian.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/archive/tools/tiffmedian.c b/archive/tools/tiffmedian.c +index b3b2671..3d5c9ca 100644 +--- a/archive/tools/tiffmedian.c ++++ b/archive/tools/tiffmedian.c +@@ -915,7 +915,7 @@ static void quant_fsdither(TIFF *in, TIFF *out) + outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out)); + + GetInputLine(in, 0, goto bad); /* get first line */ +- for (i = 0; i <= imagelength; ++i) ++ for (i = 0; i < imagelength; ++i) + { + SWAP(short *, thisline, nextline); + lastline = (i >= imax); +-- +2.45.4 + diff --git a/SPECS/libtiff/CVE-2025-8177.patch b/SPECS/libtiff/CVE-2025-8177.patch new file mode 100644 index 00000000000..92468217fe9 --- /dev/null +++ b/SPECS/libtiff/CVE-2025-8177.patch @@ -0,0 +1,26 @@ +From 924ba29b55678da1e158eacefca3a378aaa9b484 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Mon, 23 Jun 2025 10:09:07 -0700 +Subject: [PATCH] set a default value - assumes cmap[0] was not, itself, + uninitialized + +--- + archive/tools/thumbnail.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/archive/tools/thumbnail.c b/archive/tools/thumbnail.c +index a94a738..237d99e 100644 +--- a/archive/tools/thumbnail.c ++++ b/archive/tools/thumbnail.c +@@ -627,7 +627,7 @@ static void setrow(uint8_t *row, uint32_t nrows, const uint8_t *rows[]) + else + { + fprintf(stderr, "acc=%d, area=%d\n", acc, area); +- row++; ++ *row++ = cmap[0]; + } + } + } +-- +2.45.4 + diff --git a/SPECS/libtiff/libtiff.spec b/SPECS/libtiff/libtiff.spec index 2e3e3b55948..bff548ff868 100644 --- a/SPECS/libtiff/libtiff.spec +++ b/SPECS/libtiff/libtiff.spec @@ -1,7 +1,7 @@ Summary: TIFF libraries and associated utilities. Name: libtiff Version: 4.6.0 -Release: 6%{?dist} +Release: 7%{?dist} License: libtiff Vendor: Microsoft Corporation Distribution: Azure Linux @@ -13,6 +13,8 @@ Patch1: CVE-2023-6277.patch Patch2: CVE-2024-7006.patch Patch3: CVE-2023-3164.patch Patch4: CVE-2023-6228.patch +Patch5: CVE-2025-8177.patch +Patch6: CVE-2025-8176.patch BuildRequires: autoconf BuildRequires: automake @@ -66,6 +68,9 @@ make %{?_smp_mflags} -k check %{_docdir}/* %changelog +* Thu Jul 31 2025 Azure Linux Security Servicing Account - 4.6.0-7 +- Patch for CVE-2025-8177, CVE-2025-8176 + * Mon Feb 03 2025 Ankita Pareek - 4.6.0-6 - Address CVE-2023-6228 with a patch