SUSE-SU-2026:3054-1

Details

Description of the patch:

This update for tiff fixes the following issues

CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value (bsc#1268434).

Affected Packages

libtiff5

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

4.0.9-150000.45.69.1

libtiff5-32bit

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5

Fixed in:

4.0.9-150000.45.69.1

libtiff-devel

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

4.0.9-150000.45.69.1

References

ADVISORY

https://bugzilla.suse.com/1268434

ADVISORY

https://bugzilla.suse.com/1269779

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-July/048331.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-12912/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-36849/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20263054-1/