Public bug reported:
A new release of tiff is available for merging from Debian.
Ubuntu: 4.7.1-2ubuntu1
Debian Unstable: 4.7.2-1
### New Debian Changes ###
tiff (4.7.2-1) unstable; urgency=high
* New upstream release:
- fixes CVE-2026-12912: heap buffer-overflow in PixarLogDecode()
(closes: #1141320).
* Update libtiff6 symbols.
-- Laszlo Boszormenyi (GCS) <[email protected]> Fri, 03 Jul 2026 16:47:16
+0200
tiff (4.7.1-3) unstable; urgency=high
[ Laszlo Boszormenyi (GCS) ]
* Backport security fix for CVE-2026-36849, denial of service via large
SamplesPerPixel tag (closes: #1140300).
* Update libtiff6 symbols.
[ Helmut Grohne <[email protected]> ]
* Fix FTCBFS: Annotate sphinx dependency :native (closes: #1086689).
-- Laszlo Boszormenyi (GCS) <[email protected]> Thu, 18 Jun 2026 19:44:21
+0200
### Old Ubuntu Delta ###
tiff (4.7.1-2ubuntu1) stonking; urgency=medium
* Merge from Debian unstable (LP: #2153363). Remaining changes:
- Don't build with LERC on i386 because it requires numpy (Closes: #1017958)
* Drop Changes:
- d/p/CVE-2025-8176.patch: fix heap use-after-free in tiffmedian
[Fixed in 4.7.1]
- d/p/CVE-2025-8534.patch: tiff2ps: check return of TIFFGetFiled() to fix
[Fixed in 4.7.1]
- d/p/CVE-2025-8961.patch: Add _TIFFfree and extra read_buff check
in tools/tiffcrop.c.
[Fixed in 4.7.1]
- d/p/CVE-2025-9165.patch: Add TIFFClose in tools/tiffcmp.c.
[Fixed in 4.7.1]
- d/p/CVE-2025-9900.patch: Add img->height and img->width checks
in libtiff/tif_getimage.c.
[Fixed in 4.7.1]
-- Simon Poirier <[email protected]> Thu, 21 May 2026
11:46:25 -0400
** Affects: tiff (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: tiff (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: tiff (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171259
Title:
Merge tiff 4.7.2-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/2171259/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
