🛡️ openSUSE-SU-2025:20049-1 — tiff (CVE-2025-9900 +6 more)

Security update for tiff

This update for tiff fixes the following issues:

tiff was updated to 4.7.1:

• Software configuration changes:
• Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
• CMake: define WORDS_BIGENDIAN via tif_config.h
• doc/CMakeLists.txt: remove useless cmake_minimum_required()
• CMake: fix build with LLVM/Clang 17 (fixes issue #651)
• CMake: set CMP0074 new policy
• Set LINKER_LANGUAGE for C targets with C deps
• Export tiffxx cmake target (fixes issue #674)
• autogen.sh: Enable verbose wget.
• configure.ac: Syntax updates for Autoconf 2.71
• autogen.sh: Re-implement based on autoreconf. Failure to update

config.guess/config.sub does not return error (fixes issue #672)

• CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
• CMake: Add build option tiff-static (fixes issue #709)

Library changes:

• Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control

about emitting warnings for unknown tags. No longer emit warnings

about unknown tags by default

• tif_predict.c: speed-up decompression in some cases.
• Bug fixes:
• tif_fax3: For fax group 3 data if no EOL is detected, reading is

retried without synchronisation for EOLs. (fixes issue #54)

• Updating TIFFMergeFieldInfo() with read_count=write_count=0 for

FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for

FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)

• tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in

the DNG 1.7 specification

• TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags

defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)

• Do not error out on a tag whose tag count value is zero, just issue a warning.

Fix parsing a private tag 0x80a6 (fixes issue #647)

• TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24

Fixes https://github.com/OSGeo/gdal/issues/10875)

• tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
• Fix writing a Predictor=3 file with non-native endianness
• _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
• read / nullptr dereference) in case of out-of-memory situation when dealing with

custom tags (fixes issue #663)

• tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and

PlanarConfiguration = Contiguous (fixes issue #26)

• tif_fax3.c: error out after a number of times end-of-line or unexpected bad code

words have been reached. (fixes issue #670)

• Fix memory leak in TIFFSetupStrips() (fixes issue #665)
• tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with

-DZ_SOLO inflating will fail.

• Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
• tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction"

is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)

• tif_getimage.c: update some integer overflow checks (fixes issue #79)
• tif_getimage.c: Fix buffer underflow crash for less raster rows at

TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)

• TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
• Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative()

if HAVE_IEEEFP is not defined. (fixes issue #699)

• LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker

has been found with remaining output bytes (fixes issue #698)

• TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
• TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing

tif_rawdata (fixes issue #711)

• JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid

out-of-bounds access (fixes issue #714)

• tif_jpeg: Fix bug in JPEGDecodeRaw() if JPEG_LIB_MK1_OR_12BIT is defined for 8/12bit

dual mode, introduced in libjpeg-turbo 2.2, which was actually released as 3.0.

Fixes issue #717

• add assert for TIFFReadCustomDirectory infoarray check.
• ppm2tiff: Fix bug in pack_words trailing bytes, where last two bytes of each line

were written wrongly. (fixes issue #467)

• fax2ps: fix regression of commit 28c38d648b64a66c3218778c4745225fe3e3a06d where

TIFFTAG_FAXFILLFUNC is being used rather than an output buffer (fixes issue #649)

• tiff2pdf: Check TIFFTAG_TILELENGTH and TIFFTAGTILEWIDTH (fixes issue #650)
• tiff2pdf: check h_samp and v_samp for range 1 to 4 to avoid division by zero.

Fixes issue #654

• tiff2pdf: avoid null pointer dereference. (fixes issue #741)
• Improve non-secure integer overflow check (comparison of division result with

multiplicant) at compiler optimisation in tiffcp, rgb2ycbcr and tiff2rgba.

Fixes issue #546

• tiff2rgba: fi