[AutoPR- Security] Patch libtiff for CVE-2025-8177, CVE-2025-8176 [LOW]

SPECS/libtiff/CVE-2025-8176.patch

@@ -0,0 +1,25 @@
+From 10032ccd085e2c8cd1b6905c2bce56789ab39165 Mon Sep 17 00:00:00 2001
+From: Lee Howard <[email protected]>
+Date: Sat, 24 May 2025 21:38:09 -0700
+Subject: [PATCH] conflict resolution
+
+---
+ archive/tools/tiffmedian.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/archive/tools/tiffmedian.c b/archive/tools/tiffmedian.c
+index b3b2671..3d5c9ca 100644
+--- a/archive/tools/tiffmedian.c
++++ b/archive/tools/tiffmedian.c
+@@ -915,7 +915,7 @@ static void quant_fsdither(TIFF *in, TIFF *out)
+     outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+
+     GetInputLine(in, 0, goto bad); /* get first line */
+-    for (i = 0; i <= imagelength; ++i)
++    for (i = 0; i < imagelength; ++i)
+     {
+         SWAP(short *, thisline, nextline);
+         lastline = (i >= imax);
+-- 
+2.45.4
+

SPECS/libtiff/CVE-2025-8177.patch

@@ -0,0 +1,26 @@
+From 924ba29b55678da1e158eacefca3a378aaa9b484 Mon Sep 17 00:00:00 2001
+From: Lee Howard <[email protected]>
+Date: Mon, 23 Jun 2025 10:09:07 -0700
+Subject: [PATCH] set a default value - assumes cmap[0] was not, itself,
+ uninitialized
+
+---
+ archive/tools/thumbnail.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/archive/tools/thumbnail.c b/archive/tools/thumbnail.c
+index a94a738..237d99e 100644
+--- a/archive/tools/thumbnail.c
++++ b/archive/tools/thumbnail.c
+@@ -627,7 +627,7 @@ static void setrow(uint8_t *row, uint32_t nrows, const uint8_t *rows[])
+         else
+         {
+             fprintf(stderr, "acc=%d, area=%d\n", acc, area);
+-            row++;
++            *row++ = cmap[0];
+         }
+     }
+ }
+-- 
+2.45.4
+

SPECS/libtiff/libtiff.spec

@@ -1,7 +1,7 @@
 Summary:        TIFF libraries and associated utilities.
 Name:           libtiff
 Version:        4.6.0
-Release:        6%{?dist}
+Release:        7%{?dist}
 License:        libtiff
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -13,6 +13,8 @@ Patch1:         CVE-2023-6277.patch
 Patch2:         CVE-2024-7006.patch
 Patch3:         CVE-2023-3164.patch
 Patch4:         CVE-2023-6228.patch
+Patch5:         CVE-2025-8177.patch
+Patch6:         CVE-2025-8176.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -66,6 +68,9 @@ make %{?_smp_mflags} -k check
 %{_docdir}/*
 
 %changelog
+* Thu Jul 31 2025 Azure Linux Security Servicing Account <[email protected]> - 4.6.0-7
+- Patch for CVE-2025-8177, CVE-2025-8176
+
 * Mon Feb 03 2025 Ankita Pareek <[email protected]> - 4.6.0-6
 - Address CVE-2023-6228 with a patch