[CLSA-2026:1790602508] libtiff: Fix of 6 CVEs
Type:
security
Severity:
None
Release date:
2026-09-28 13:35:17 UTC
Description:
- rebase to 4.0.3-35.amzn2.0.32, which fixes CVE-2026-52490, CVE-2026-52491 and CVE-2026-52492 - fix CVE-2023-30774; the vendor fixed it in 4.0.3-35.amzn2.0.16 but the patch was never carried onto this branch, so it lands here for the first time - harden the CVE-2026-52492 fix: check the rgb2ycbcr allocations for failure - retain CVE-2023-52355: cap libtiff allocations via TIFFOpenOptionsSetMaxSingleMemAlloc and the -M memory-limit option for tiff2ps, tiffcp, tiffinfo and tiffsplit; AL2 still does not fix this - retain the CVE-2026-12912 follow-up: the upstream multi-row ABGR bounds check (f9bda11b + 90601d9a) that AL2's CVE-2026-12912 patch omits - renumber the TuxCare patches to 1040-1042; AL2 0.32 now occupies 1028-1032
Updated packages:
  • libtiff-4.0.3-35.amzn2.0.32.tuxcare.els1.aarch64.rpm
    sha:63011fe357675d8d123f3c6224adb09850aaa71bf02f4b85ad5e1751514078d2
  • libtiff-4.0.3-35.amzn2.0.32.tuxcare.els1.i686.rpm
    sha:da36412eb62de3596282238a9749ae50a30cd6fca789bac29397c8ab78e81ca1
  • libtiff-4.0.3-35.amzn2.0.32.tuxcare.els1.x86_64.rpm
    sha:6712315569f11b5b5ddfc053cc4f1fba85b62efc520823e550d2aae9c291a116
  • libtiff-devel-4.0.3-35.amzn2.0.32.tuxcare.els1.aarch64.rpm
    sha:c2f5a8f9eef3ce58fe2c8c0a6c736b813b5de3cf6330f4287cfa5a8b498662f6
  • libtiff-devel-4.0.3-35.amzn2.0.32.tuxcare.els1.i686.rpm
    sha:4e3742de9afa832c3143ddcdc2dc6046a72f7031489c17fef90ccb27e5ea6d4e
  • libtiff-devel-4.0.3-35.amzn2.0.32.tuxcare.els1.x86_64.rpm
    sha:865bd6dfe36152c14f8b9f5a2d134b658d574753dcd0fd05e9e8443aa38e93e3
  • libtiff-static-4.0.3-35.amzn2.0.32.tuxcare.els1.aarch64.rpm
    sha:bcd2afe0d8ce4dfc8a8643aa37bad8f241690b8eb52c6306f6700a59dbcd1571
  • libtiff-static-4.0.3-35.amzn2.0.32.tuxcare.els1.i686.rpm
    sha:58409055f167fbe9dec93a8da07f62d35d42e5c73f0357a0ddc5bd9813147bd5
  • libtiff-static-4.0.3-35.amzn2.0.32.tuxcare.els1.x86_64.rpm
    sha:c982d5b81d33b74845531e481bfa3c552add8b6343400347e773f758252212b7
  • libtiff-tools-4.0.3-35.amzn2.0.32.tuxcare.els1.aarch64.rpm
    sha:6fd389b2348b10f876fc0a496d53639e0a52be2541eb3d0359d3fe1b6966ee0b
  • libtiff-tools-4.0.3-35.amzn2.0.32.tuxcare.els1.i686.rpm
    sha:46cc1280036979e630b12e5289a01cee4a2117b4002c9a11e32b3ec429e39a31
  • libtiff-tools-4.0.3-35.amzn2.0.32.tuxcare.els1.x86_64.rpm
    sha:1c23bd434ec64aaa4ddc986041cf5bf8294f1201a7e66f953ea6481b2e5fa5df
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.