Greg, yes I should probably try to tackle a 4.7.2 release soon.
Personally the particular fix you point is not something that would prevent me from sleeping (hopefully no libtiff stuff is vital for anyone :-)) if it wasn't fixed, given that denial of service like scenarios are pretty much inevitable for a format with so few limitations encoded in the spec. You'll always run into some formulation of files that will consume enormous amount of CPU time or RAM. I guess we could sell that as a feature, not a bug :-)
The official commit for that issue is https://gitlab.com/libtiff/libtiff/-/commit/eedba405d3695b52faae65994c5904f228eca0bf
There have been fixes for more concerning issues that have been applied, so it doesn't make sense to pick that one and not other ones .
Even Le 17/06/2026 à 19:29, Greg Troxel via Tiff a écrit :
I just got a forwarded copy of a note to oss-security@, at end. Reading the linked issue, I know there were multiple issues with proposed patches, and I'm very reluctant to take a patch from other than upstream. I am wondering if there is a plan for 4.7.2, as reviewing commits looks like mostly fixes and CI stuff. Alternatively, I wonder if anyone has identified the commits by sha1 that should be cherry-picked, or if this is a theoretical DOS that isn't worth worrying about. I am 10% of the way to understanding the merges, but only 10%. ---------------------------------------- From: Ryo utomo <[email protected]> Subject: [oss-security] [CVE-2026-36849] libtiff: Denial of Service via large SamplesPerPixel tag To: [email protected] Date: Tue, 16 Jun 2026 17:13:49 -0700 (17 hours, 8 minutes, 21 seconds ago) Hi, I would like to disclose CVE-2026-36849, a denial of service vulnerability in libtiff. == Summary == An issue in libtiff v4.7.1 allows an attacker to cause a denial of service via a crafted TIFF file containing a large SamplesPerPixel tag value. == Affected Versions == libtiff v4.7.1 and prior == Patch == https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/eedba405d3695b52faae65994c5904f228eca0bf == References == - CVE: CVE-2026-36849 - Issue: https://gitlab.com/libtiff/libtiff/-/work_items/781 Regards, Satriyo Utomo (aleens-lab) _______________________________________________ Tiff mailing list [email protected] https://lists.osgeo.org/mailman/listinfo/tiff
-- http://www.spatialys.com My software is free, but my time generally not. _______________________________________________ Tiff mailing list [email protected] https://lists.osgeo.org/mailman/listinfo/tiff
