Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:tiff
User: [email protected]
Usertags: pu
[ Reason ]
Three sec issues were found in the tiff:
* CVE-2026-52490: unsigned 32-bit integer overflow in the tiffcrop "-S"
subdivision count computation (page->cols * page->rows) in
tools/tiffcrop.c, which can lead to an out-of-bounds access.
* CVE-2026-18495: heap-based buffer overflow caused by truncation of
64-bit StripByteCounts values when processing crafted BigTIFF files.
* CVE-2026-36849: denial of service when processing a crafted TIFF file
containing a large SamplesPerPixel tag value.
None of these are regressions with respecto the the previous trixie version
[ Impact ]
If the update is not in trixie, libtiff and the command line tool in
trixie remain vulnerable to the tree issue mentioned above, one of
them a DoS.
[ Tests ]
Tests run in debusine
https://debusine.debian.net/debian/developers/work-request/1426324/
[ Risks ]
Low, the changes are self-contained backports
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
