This update for tiff fixes the following issues:
Update to version 4.7.2.
Security issues fixed:
- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value
(bsc#1268434).
Other updates and bugfixes:
- Version 4.7.2:
- Software configuration changes:
* cmake: Fix bundle identifiers to use reverse-DNS format
* cmake: Fix and improve Apple framework build support
* cmake: Use TurboJPEG CONFIG by default (issue #767)
* cmake: changes related to 8-/12
This update for tiff fixes the following issues:
Update to 4.7.1:
- CVE-2025-8851: Fixed stack-based buffer overflow (bsc#1248278).
- CVE-2025-9900: Fixed write-what-where via TIFFReadRGBAImageOriented (bsc#1250413).
This update for tiff fixes the following issues:
- CVE-2025-9165: local execution manipulation leading to memory leak (bsc#1248330).
- CVE-2024-13978: null pointer dereference in component fax2ps (bsc#1247581)
- CVE-2025-8534: null pointer dereference in function PS_Lvl2page (bsc#1247582).
- CVE-2025-8961: segmentation fault via main function of tiffcrop utility (bsc#1248117).
This update for tiff fixes the following issues:
- Updated TIFFMergeFieldInfo() with read_count=write_count=0 for FIELD_IGNORE (bsc#1243503)
- CVE-2025-8176: Fixed heap use-after-free in tools/tiffmedian.c (bsc#1247108)
- CVE-2025-8177: Fixed possible buffer overflow in tools/thumbnail.c:setrow()
when processing malformed TIFF files (bsc#1247106)
- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Add %check section
- Remove Group: declarations, no longer used