Skip to content

Commit c7d20b2

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch libtiff for CVE-2025-8534, CVE-2025-8177, CVE-2025-8176 [LOW] (#14437)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent b727a03 commit c7d20b2

File tree

4 files changed

+247
-1
lines changed

4 files changed

+247
-1
lines changed

‎SPECS/libtiff/CVE-2025-8176.patch

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
From 80c3f0f9ca0e882c4af1b98ccf473411ccbc123f Mon Sep 17 00:00:00 2001
2+
From: Lee Howard <[email protected]>
3+
Date: Mon, 19 May 2025 10:53:30 -0700
4+
Subject: [PATCH 1/3] Don't skip the first line of the input image. Addresses
5+
issue #703
6+
7+
---
8+
archive/tools/tiffdither.c | 4 ++--
9+
archive/tools/tiffmedian.c | 4 ++--
10+
2 files changed, 4 insertions(+), 4 deletions(-)
11+
12+
diff --git a/archive/tools/tiffdither.c b/archive/tools/tiffdither.c
13+
index 187a61a..0c86e7f 100644
14+
--- a/archive/tools/tiffdither.c
15+
+++ b/archive/tools/tiffdither.c
16+
@@ -98,7 +98,7 @@ static int fsdither(TIFF *in, TIFF *out)
17+
nextptr = nextline;
18+
for (j = 0; j < imagewidth; ++j)
19+
*nextptr++ = *inptr++;
20+
- for (i = 1; i < imagelength; ++i)
21+
+ for (i = 0; i < imagelength; ++i)
22+
{
23+
tmpptr = thisline;
24+
thisline = nextline;
25+
@@ -146,7 +146,7 @@ static int fsdither(TIFF *in, TIFF *out)
26+
nextptr[0] += v / 16;
27+
}
28+
}
29+
- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0)
30+
+ if (TIFFWriteScanline(out, outline, i, 0) < 0)
31+
goto skip_on_error;
32+
}
33+
goto exit_label;
34+
diff --git a/archive/tools/tiffmedian.c b/archive/tools/tiffmedian.c
35+
index 334566a..291e73b 100644
36+
--- a/archive/tools/tiffmedian.c
37+
+++ b/archive/tools/tiffmedian.c
38+
@@ -912,7 +912,7 @@ static void quant_fsdither(TIFF *in, TIFF *out)
39+
outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
40+
41+
GetInputLine(in, 0, goto bad); /* get first line */
42+
- for (i = 1; i <= imagelength; ++i)
43+
+ for (i = 0; i <= imagelength; ++i)
44+
{
45+
SWAP(short *, thisline, nextline);
46+
lastline = (i >= imax);
47+
@@ -992,7 +992,7 @@ static void quant_fsdither(TIFF *in, TIFF *out)
48+
nextptr += 3;
49+
}
50+
}
51+
- if (TIFFWriteScanline(out, outline, i - 1, 0) < 0)
52+
+ if (TIFFWriteScanline(out, outline, i, 0) < 0)
53+
break;
54+
}
55+
bad:
56+
--
57+
2.45.4
58+
59+
60+
From e39690d84c229788cdceec9cd4d11f46aad72da7 Mon Sep 17 00:00:00 2001
61+
From: Lee Howard <[email protected]>
62+
Date: Sat, 24 May 2025 21:25:16 -0700
63+
Subject: [PATCH 2/3] Fix tiffmedian bug #707
64+
65+
---
66+
archive/tools/tiffmedian.c | 5 ++++-
67+
1 file changed, 4 insertions(+), 1 deletion(-)
68+
69+
diff --git a/archive/tools/tiffmedian.c b/archive/tools/tiffmedian.c
70+
index 291e73b..b3b2671 100644
71+
--- a/archive/tools/tiffmedian.c
72+
+++ b/archive/tools/tiffmedian.c
73+
@@ -410,7 +410,10 @@ static void get_histogram(TIFF *in, Colorbox *box)
74+
for (i = 0; i < imagelength; i++)
75+
{
76+
if (TIFFReadScanline(in, inputline, i, 0) <= 0)
77+
- break;
78+
+ {
79+
+ fprintf(stderr, "Error reading scanline\n");
80+
+ exit(EXIT_FAILURE);
81+
+ }
82+
inptr = inputline;
83+
for (j = imagewidth; j-- > 0;)
84+
{
85+
--
86+
2.45.4
87+
88+
89+
From 0f6f0eaeefe9e98e41b96d9a47292c41e1fdf66d Mon Sep 17 00:00:00 2001
90+
From: Lee Howard <[email protected]>
91+
Date: Sat, 24 May 2025 21:38:09 -0700
92+
Subject: [PATCH 3/3] conflict resolution
93+
94+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
95+
Upstream-reference: https://gitlab.com/libtiff/libtiff/-/merge_requests/727.patch
96+
---
97+
archive/tools/tiffmedian.c | 2 +-
98+
1 file changed, 1 insertion(+), 1 deletion(-)
99+
100+
diff --git a/archive/tools/tiffmedian.c b/archive/tools/tiffmedian.c
101+
index b3b2671..3d5c9ca 100644
102+
--- a/archive/tools/tiffmedian.c
103+
+++ b/archive/tools/tiffmedian.c
104+
@@ -915,7 +915,7 @@ static void quant_fsdither(TIFF *in, TIFF *out)
105+
outline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
106+
107+
GetInputLine(in, 0, goto bad); /* get first line */
108+
- for (i = 0; i <= imagelength; ++i)
109+
+ for (i = 0; i < imagelength; ++i)
110+
{
111+
SWAP(short *, thisline, nextline);
112+
lastline = (i >= imax);
113+
--
114+
2.45.4
115+

‎SPECS/libtiff/CVE-2025-8177.patch

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
From 853f57d485fa4df27f8dffc7c691f320320a9506 Mon Sep 17 00:00:00 2001
2+
From: Lee Howard <[email protected]>
3+
Date: Thu, 19 Jun 2025 11:51:33 -0700
4+
Subject: [PATCH 1/2] Fix for thumbnail issue #715
5+
6+
---
7+
archive/tools/thumbnail.c | 10 +++++++++-
8+
1 file changed, 9 insertions(+), 1 deletion(-)
9+
10+
diff --git a/archive/tools/thumbnail.c b/archive/tools/thumbnail.c
11+
index 8ce0d9b..a94a738 100644
12+
--- a/archive/tools/thumbnail.c
13+
+++ b/archive/tools/thumbnail.c
14+
@@ -620,7 +620,15 @@ static void setrow(uint8_t *row, uint32_t nrows, const uint8_t *rows[])
15+
}
16+
acc += bits[*src & mask1];
17+
}
18+
- *row++ = cmap[(255 * acc) / area];
19+
+ if (255 * acc / area < 256)
20+
+ {
21+
+ *row++ = cmap[(255 * acc) / area];
22+
+ }
23+
+ else
24+
+ {
25+
+ fprintf(stderr, "acc=%d, area=%d\n", acc, area);
26+
+ row++;
27+
+ }
28+
}
29+
}
30+
31+
--
32+
2.45.4
33+
34+
35+
From 026ac684b76ea9c393c616e6d3ba67a609bc751c Mon Sep 17 00:00:00 2001
36+
From: Lee Howard <[email protected]>
37+
Date: Mon, 23 Jun 2025 10:09:07 -0700
38+
Subject: [PATCH 2/2] set a default value - assumes cmap[0] was not, itself,
39+
uninitialized
40+
41+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
42+
Upstream-reference: https://gitlab.com/libtiff/libtiff/-/merge_requests/737.patch
43+
---
44+
archive/tools/thumbnail.c | 2 +-
45+
1 file changed, 1 insertion(+), 1 deletion(-)
46+
47+
diff --git a/archive/tools/thumbnail.c b/archive/tools/thumbnail.c
48+
index a94a738..237d99e 100644
49+
--- a/archive/tools/thumbnail.c
50+
+++ b/archive/tools/thumbnail.c
51+
@@ -627,7 +627,7 @@ static void setrow(uint8_t *row, uint32_t nrows, const uint8_t *rows[])
52+
else
53+
{
54+
fprintf(stderr, "acc=%d, area=%d\n", acc, area);
55+
- row++;
56+
+ *row++ = cmap[0];
57+
}
58+
}
59+
}
60+
--
61+
2.45.4
62+

‎SPECS/libtiff/CVE-2025-8534.patch

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
From ca74283defdcb02685da93e63e9f93d05f4bf547 Mon Sep 17 00:00:00 2001
2+
From: Su_Laus <[email protected]>
3+
Date: Sat, 2 Aug 2025 18:55:54 +0200
4+
Subject: [PATCH] tiff2ps: check return of TIFFGetFiled() for
5+
TIFFTAG_STRIPBYTECOUNTS and TIFFTAG_TILEBYTECOUNTS to avoid NULL pointer
6+
dereference.
7+
8+
Closes #718
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
11+
Upstream-reference: https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b.patch
12+
---
13+
tools/unsupported/tiff2ps.c | 20 +++++++++++++++++---
14+
1 file changed, 17 insertions(+), 3 deletions(-)
15+
16+
diff --git a/tools/unsupported/tiff2ps.c b/tools/unsupported/tiff2ps.c
17+
index 541495d..d6a54b4 100644
18+
--- a/tools/unsupported/tiff2ps.c
19+
+++ b/tools/unsupported/tiff2ps.c
20+
@@ -2432,12 +2432,22 @@ int PS_Lvl2page(FILE *fd, TIFF *tif, uint32_t w, uint32_t h)
21+
if (tiled_image)
22+
{
23+
num_chunks = TIFFNumberOfTiles(tif);
24+
- TIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);
25+
+ if (!TIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc))
26+
+ {
27+
+ TIFFError(filename,
28+
+ "Can't read bytecounts of tiles at PS_Lvl2page()");
29+
+ return (FALSE);
30+
+ }
31+
}
32+
else
33+
{
34+
num_chunks = TIFFNumberOfStrips(tif);
35+
- TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);
36+
+ if (!TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc))
37+
+ {
38+
+ TIFFError(filename,
39+
+ "Can't read bytecounts of strips at PS_Lvl2page()");
40+
+ return (FALSE);
41+
+ }
42+
}
43+
44+
if (use_rawdata)
45+
@@ -3107,7 +3117,11 @@ void PSRawDataBW(FILE *fd, TIFF *tif, uint32_t w, uint32_t h)
46+
(void)w;
47+
(void)h;
48+
TIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);
49+
- TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);
50+
+ if (!TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc))
51+
+ {
52+
+ TIFFError(filename, "Can't read bytecounts of strips at PSRawDataBW()");
53+
+ return;
54+
+ }
55+
56+
/*
57+
* Find largest strip:
58+
--
59+
2.45.4
60+

‎SPECS/libtiff/libtiff.spec

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: TIFF libraries and associated utilities.
22
Name: libtiff
33
Version: 4.6.0
4-
Release: 6%{?dist}
4+
Release: 7%{?dist}
55
License: libtiff
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -13,6 +13,9 @@ Patch1: CVE-2023-6277.patch
1313
Patch2: CVE-2024-7006.patch
1414
Patch3: CVE-2023-3164.patch
1515
Patch4: CVE-2023-6228.patch
16+
Patch5: CVE-2025-8534.patch
17+
Patch6: CVE-2025-8177.patch
18+
Patch7: CVE-2025-8176.patch
1619

1720
BuildRequires: autoconf
1821
BuildRequires: automake
@@ -63,9 +66,15 @@ make %{?_smp_mflags} -k check
6366
%{_includedir}/*
6467
%{_libdir}/*.so
6568
%{_libdir}/pkgconfig/*.pc
69+
%license LICENSE.md
6670
%{_docdir}/*
71+
# The above LICENSE.md is same as below hence removing duplicate in doc file
72+
%exclude %{_docdir}/tiff-%{version}/LICENSE.md
6773

6874
%changelog
75+
* Tue Aug 05 2025 Azure Linux Security Servicing Account <[email protected]> - 4.6.0-7
76+
- Patch for CVE-2025-8534, CVE-2025-8177, CVE-2025-8176
77+
6978
* Mon Feb 03 2025 Ankita Pareek <[email protected]> - 4.6.0-6
7079
- Address CVE-2023-6228 with a patch
7180

0 commit comments

Comments
 (0)