Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-12912 (GCVE-0-2026-12912)
Vulnerability from cvelistv5 – Published: 2026-06-29 16:31 – Updated: 2026-08-14 12:04
VLAI
EPSS
VEX
Title
Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
Summary
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
15 references
Impacted products
27 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:4.6.0-8.el10_2.4 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:4.6.0-6.el10_0.4 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
||
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:3.9.4-16.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:4.0.9-38.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:3.9.4-13.el8_4.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:3.9.4-13.el8_4.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:3.9.4-13.el8_6.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On |
Unaffected:
0:3.9.4-13.el8_6.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:3.9.4-13.el8_8.3 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:3.9.4-13.el8_8.3 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:4.4.0-18.el9_8.1 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb |
||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:4.4.0-13.el9_6.6 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
4.7.1-2.4.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
||
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:3.9.4-16.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
||
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:4.0.9-38.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:3.9.4-13.el8_4.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4 |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:3.9.4-13.el8_4.3 , < *
(rpm)
cpe:/a:redhat:rhel_eus_long_life:8.4 |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:3.9.4-13.el8_6.3 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6 |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On |
Unaffected:
0:3.9.4-13.el8_6.3 , < *
(rpm)
cpe:/a:redhat:rhel_eus_long_life:8.6 |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:3.9.4-13.el8_8.3 , < *
(rpm)
cpe:/a:redhat:rhel_tus:8.8 |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:3.9.4-13.el8_8.3 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8 |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:4.4.0-18.el9_8.1 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:4.4.0-13.el9_6.6 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6 |
Date Public
2026-04-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T03:55:36.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-8.el10_2.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-6.el10_0.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-16.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-38.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-18.el9_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-13.el9_6.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libtiff-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.7.1-2.4.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mingw-libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "boost",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T12:04:27.620Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"name": "RHBZ#2492871",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34890"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49671: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:41892: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:47183: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47184: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:54642: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:54640: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:54638: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:50774: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:42668: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:34890: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-8.el10_2.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-6.el10_0.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-16.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-38.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-18.el9_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-13.el9_6.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libtiff-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.7.1-2.4.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mingw-libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "boost",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Ariel Sch\u00f6n for reporting this issue."
}
],
"datePublic": "2026-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:04:40.019Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:34890",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34890"
},
{
"name": "RHSA-2026:41892",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"name": "RHSA-2026:42668",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"name": "RHSA-2026:47183",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"name": "RHSA-2026:47184",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"name": "RHSA-2026:49671",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"name": "RHSA-2026:50774",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"name": "RHSA-2026:54638",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"name": "RHSA-2026:54640",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"name": "RHSA-2026:54642",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"name": "RHBZ#2492871",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-12912",
"datePublished": "2026-06-29T16:31:34.581Z",
"dateReserved": "2026-06-22T15:36:26.194Z",
"dateUpdated": "2026-08-14T12:04:27.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-12912",
"date": "2026-08-18",
"epss": "0.00258",
"percentile": "0.17622"
},
"microsoft_vex": {
"current_release_date": "2026-07-09T14:39:20.000Z",
"cve": "CVE-2026-12912",
"id": "msrc_CVE-2026-12912",
"initial_release_date": "2026-06-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-12912.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-12912\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-06-29T17:16:28.230\",\"lastModified\":\"2026-08-14T13:17:35.063\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:4.6.0-8.el10_2.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:4.6.0-6.el10_0.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-16.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\",\"cpe:/a:redhat:enterprise_linux:8::crb\"],\"versions\":[{\"version\":\"0:4.0.9-38.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_4.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_4.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_6.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_6.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_8.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_8.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/a:redhat:enterprise_linux:9::crb\"],\"versions\":[{\"version\":\"0:4.4.0-18.el9_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\",\"cpe:/a:redhat:rhel_eus:9.6::crb\"],\"versions\":[{\"version\":\"0:4.4.0-13.el9_6.6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"libtiff-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"4.7.1-2.4.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mingw-libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"boost\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:4.6.0-8.el10_2.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:4.6.0-6.el10_0.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:3.9.4-16.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:4.0.9-38.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_4.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_4.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_6.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.6\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_6.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_8.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8\"],\"versions\":[{\"version\":\"0:3.9.4-13.el8_8.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:4.4.0-18.el9_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"0:4.4.0-13.el9_6.6\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"4.7.1-2.4.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compat-libtiff3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mingw-libtiff\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"boost\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-29T00:00:00+00:00\",\"id\":\"CVE-2026-12912\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34890\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41892\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42668\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47183\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47184\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:49671\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50774\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54638\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54640\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54642\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-12912\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2492871\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.com/libtiff/libtiff/-/merge_requests/873\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.com/libtiff/libtiff/-/work_items/824\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34890\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41892\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47183\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47184\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:49671\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50774\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54638\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54640\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54642\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-12912\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2492871\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-13T22:04:35+00:00",
"cve": "CVE-2026-12912",
"id": "CVE-2026-12912",
"initial_release_date": "2026-04-16T00:00:00+00:00",
"product_status:fixed": "238",
"product_status:known_affected": "16",
"product_status:known_not_affected": "27",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.0-8.el10_2.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.0-6.el10_0.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-16.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.0.9-38.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.4.0-18.el9_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.4.0-13.el9_6.6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.7.1-2.4.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"mingw-libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"boost\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-25T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-16T00:00:00.000Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:49671: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41892: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:47183: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:47184: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50774: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42668: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34890: Red Hat Hardened Images\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-16T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-12912\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2492871\", \"name\": \"RHBZ#2492871\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:49671\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41892\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47183\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50774\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34890\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-06T12:08:53.974Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-12912\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-29T18:13:06.986092Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-29T18:13:15.825Z\"}}], \"cna\": {\"title\": \"Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Ariel Sch\\u00f6n for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.0-8.el10_2.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.0-6.el10_0.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-16.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/a:redhat:enterprise_linux:8::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.0.9-38.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_4.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_4.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_6.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_6.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_8.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.9.4-13.el8_8.3\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.4.0-18.el9_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\", \"cpe:/a:redhat:rhel_eus:9.6::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.4.0-13.el9_6.6\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.7.1-2.4.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libtiff-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"compat-libtiff3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"mingw-libtiff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"boost\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-25T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-16T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-04-16T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:34890\", \"name\": \"RHSA-2026:34890\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41892\", \"name\": \"RHSA-2026:41892\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42668\", \"name\": \"RHSA-2026:42668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47183\", \"name\": \"RHSA-2026:47183\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47184\", \"name\": \"RHSA-2026:47184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:49671\", \"name\": \"RHSA-2026:49671\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50774\", \"name\": \"RHSA-2026:50774\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54638\", \"name\": \"RHSA-2026:54638\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54640\", \"name\": \"RHSA-2026:54640\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54642\", \"name\": \"RHSA-2026:54642\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-12912\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2492871\", \"name\": \"RHBZ#2492871\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://gitlab.com/libtiff/libtiff/-/merge_requests/873\"}, {\"url\": \"https://gitlab.com/libtiff/libtiff/-/work_items/824\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-13T22:04:40.019Z\"}, \"x_redhatCweChain\": \"CWE-122: Heap-based Buffer Overflow\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-12912\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T22:04:40.019Z\", \"dateReserved\": \"2026-06-22T15:36:26.194Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-06-29T16:31:34.581Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:41892
Vulnerability from csaf_redhat - Published: 2026-07-20 02:59 - Updated: 2026-08-13 22:19Summary
Red Hat Security Advisory: libtiff security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for libtiff is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
Bug Fix(es) and Enhancement(s):
* Reintroduce the `tiffcp -i` option (JIRA:RHEL-185328)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
7.5 (High)
Affected products
Fixed
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
16 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libtiff is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nBug Fix(es) and Enhancement(s):\n\n* Reintroduce the `tiffcp -i` option (JIRA:RHEL-185328)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:41892",
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41892.json"
}
],
"title": "Red Hat Security Advisory: libtiff security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-08-13T22:19:38+00:00",
"generator": {
"date": "2026-08-13T22:19:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:41892",
"initial_release_date": "2026-07-20T02:59:09+00:00",
"revision_history": [
{
"date": "2026-07-20T02:59:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-20T02:59:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:19:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-8.el10_2.4.src",
"product": {
"name": "libtiff-0:4.6.0-8.el10_2.4.src",
"product_id": "libtiff-0:4.6.0-8.el10_2.4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-8.el10_2.4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-8.el10_2.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-8.el10_2.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-8.el10_2.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-8.el10_2.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-8.el10_2.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"product": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"product_id": "libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-8.el10_2.4?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"product": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"product_id": "libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-8.el10_2.4?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-8.el10_2.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-8.el10_2.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-8.el10_2.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-8.el10_2.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-8.el10_2.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"product": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"product_id": "libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-8.el10_2.4?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-8.el10_2.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-8.el10_2.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-8.el10_2.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-8.el10_2.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-8.el10_2.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"product": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"product_id": "libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-8.el10_2.4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-8.el10_2.4.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src"
},
"product_reference": "libtiff-0:4.6.0-8.el10_2.4.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"relates_to_product_reference": "CRB-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"relates_to_product_reference": "CRB-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-52355",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251326"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The identified out-of-memory vulnerability in libtiff, triggered by a crafted TIFF file passed to the TIFFRasterScanlineSize64() API, presents a moderate severity concern rather than a important one due to several factors. Primarily, the exploit requires the crafted input to be smaller than 379 KB, imposing a limitation on the potential impact and reducing the likelihood of successful exploitation in practical scenarios. Furthermore, the nature of the vulnerability is limited to denial-of-service attacks, which, although disruptive, do not inherently pose a direct risk of data compromise or system compromise. However, it\u0027s important to acknowledge that denial-of-service attacks can still have significant operational implications, particularly in environments reliant on continuous availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "RHBZ#2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52355"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/621",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/621"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T02:59:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM"
},
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T02:59:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.src",
"AppStream-10.2.Z:libtiff-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-devel-0:4.6.0-8.el10_2.4.x86_64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"AppStream-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debuginfo-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-debugsource-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-0:4.6.0-8.el10_2.4.x86_64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.aarch64",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.ppc64le",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.s390x",
"CRB-10.2.Z:libtiff-tools-debuginfo-0:4.6.0-8.el10_2.4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:42668
Vulnerability from csaf_redhat - Published: 2026-07-21 12:31 - Updated: 2026-08-13 22:23Summary
Red Hat Security Advisory: libtiff security update
Severity
Important
Notes
Topic: An update for libtiff is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libtiff is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42668",
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42668.json"
}
],
"title": "Red Hat Security Advisory: libtiff security update",
"tracking": {
"current_release_date": "2026-08-13T22:23:02+00:00",
"generator": {
"date": "2026-08-13T22:23:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:42668",
"initial_release_date": "2026-07-21T12:31:24+00:00",
"revision_history": [
{
"date": "2026-07-21T12:31:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-21T12:31:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:23:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-18.el9_8.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-18.el9_8.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-18.el9_8.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-18.el9_8.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"product": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"product_id": "libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-18.el9_8.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-18.el9_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-18.el9_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-18.el9_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-18.el9_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"product": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"product_id": "libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-18.el9_8.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-18.el9_8.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-18.el9_8.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-18.el9_8.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-18.el9_8.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"product": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"product_id": "libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-18.el9_8.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"product": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"product_id": "libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-18.el9_8.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.i686",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.i686",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"product": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"product_id": "libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-18.el9_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"product": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"product_id": "libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-18.el9_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product_id": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-18.el9_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-18.el9_8.1?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-18.el9_8.1.src",
"product": {
"name": "libtiff-0:4.4.0-18.el9_8.1.src",
"product_id": "libtiff-0:4.4.0-18.el9_8.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-18.el9_8.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686"
},
"product_reference": "libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T12:31:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.src",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-devel-0:4.4.0-18.el9_8.1.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.i686",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-debugsource-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-0:4.4.0-18.el9_8.1.x86_64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.aarch64",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.ppc64le",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.s390x",
"CRB-9.8.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.4.0-18.el9_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:47183
Vulnerability from csaf_redhat - Published: 2026-08-03 06:55 - Updated: 2026-08-13 22:33Summary
Red Hat Security Advisory: compat-libtiff3 security update
Severity
Important
Notes
Topic: An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:47183",
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47183.json"
}
],
"title": "Red Hat Security Advisory: compat-libtiff3 security update",
"tracking": {
"current_release_date": "2026-08-13T22:33:55+00:00",
"generator": {
"date": "2026-08-13T22:33:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:47183",
"initial_release_date": "2026-08-03T06:55:41+00:00",
"revision_history": [
{
"date": "2026-08-03T06:55:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-03T06:55:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:33:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.src",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.src",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-16.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-16.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-16.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-16.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.i686",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.i686",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-16.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-16.el8_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-16.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-16.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"product": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"product_id": "compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-16.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-16.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-16.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-16.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T06:55:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debuginfo-0:3.9.4-16.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:compat-libtiff3-debugsource-0:3.9.4-16.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:47184
Vulnerability from csaf_redhat - Published: 2026-08-03 06:48 - Updated: 2026-08-13 22:33Summary
Red Hat Security Advisory: libtiff security update
Severity
Important
Notes
Topic: An update for libtiff is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libtiff is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:47184",
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47184.json"
}
],
"title": "Red Hat Security Advisory: libtiff security update",
"tracking": {
"current_release_date": "2026-08-13T22:33:51+00:00",
"generator": {
"date": "2026-08-13T22:33:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:47184",
"initial_release_date": "2026-08-03T06:48:46+00:00",
"revision_history": [
{
"date": "2026-08-03T06:48:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-03T06:48:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:33:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CRB (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.src",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.src",
"product_id": "libtiff-0:4.0.9-38.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.0.9-38.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.0.9-38.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.0.9-38.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.0.9-38.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"product": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"product_id": "libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.0.9-38.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.0.9-38.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.0.9-38.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.0.9-38.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.0.9-38.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"product": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"product_id": "libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.0.9-38.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.i686",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.i686",
"product_id": "libtiff-0:4.0.9-38.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.0.9-38.el8_10.i686",
"product": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.i686",
"product_id": "libtiff-devel-0:4.0.9-38.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.0.9-38.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"product": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"product_id": "libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.0.9-38.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"product": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"product_id": "libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.0.9-38.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"product": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"product_id": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.0.9-38.el8_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.0.9-38.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.0.9-38.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.0.9-38.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.0.9-38.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"product": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"product_id": "libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.0.9-38.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.0.9-38.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-devel-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.0.9-38.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.0.9-38.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.0.9-38.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.0.9-38.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.0.9-38.el8_10.s390x",
"product": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.s390x",
"product_id": "libtiff-tools-0:4.0.9-38.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.0.9-38.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686"
},
"product_reference": "libtiff-devel-0:4.0.9-38.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-devel-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-tools-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T06:48:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-devel-0:4.0.9-38.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debuginfo-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-debugsource-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-0:4.0.9-38.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:libtiff-tools-debuginfo-0:4.0.9-38.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:49671
Vulnerability from csaf_redhat - Published: 2026-08-03 13:40 - Updated: 2026-08-13 22:33Summary
Red Hat Security Advisory: libtiff security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for libtiff is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
Bug Fix(es) and Enhancement(s):
* Reintroduce the `tiffcp -i` option [rhel-10.0.z] (JIRA:RHEL-185417)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
7.5 (High)
Affected products
Fixed
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
16 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libtiff is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nBug Fix(es) and Enhancement(s):\n\n* Reintroduce the `tiffcp -i` option [rhel-10.0.z] (JIRA:RHEL-185417)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:49671",
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49671.json"
}
],
"title": "Red Hat Security Advisory: libtiff security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-08-13T22:33:58+00:00",
"generator": {
"date": "2026-08-13T22:33:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:49671",
"initial_release_date": "2026-08-03T13:40:08+00:00",
"revision_history": [
{
"date": "2026-08-03T13:40:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-03T13:40:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:33:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-6.el10_0.4.src",
"product": {
"name": "libtiff-0:4.6.0-6.el10_0.4.src",
"product_id": "libtiff-0:4.6.0-6.el10_0.4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-6.el10_0.4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-6.el10_0.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-6.el10_0.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-6.el10_0.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-6.el10_0.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-6.el10_0.4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"product": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"product_id": "libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-6.el10_0.4?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"product": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"product_id": "libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-6.el10_0.4?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-6.el10_0.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-6.el10_0.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-6.el10_0.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-6.el10_0.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-6.el10_0.4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"product": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"product_id": "libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-6.el10_0.4?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.6.0-6.el10_0.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.6.0-6.el10_0.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.6.0-6.el10_0.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.6.0-6.el10_0.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.6.0-6.el10_0.4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"product": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"product_id": "libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.6.0-6.el10_0.4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-6.el10_0.4.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src"
},
"product_reference": "libtiff-0:4.6.0-6.el10_0.4.src",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)",
"product_id": "CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"relates_to_product_reference": "CRB-10.0.Z.E2S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-52355",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251326"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The identified out-of-memory vulnerability in libtiff, triggered by a crafted TIFF file passed to the TIFFRasterScanlineSize64() API, presents a moderate severity concern rather than a important one due to several factors. Primarily, the exploit requires the crafted input to be smaller than 379 KB, imposing a limitation on the potential impact and reducing the likelihood of successful exploitation in practical scenarios. Furthermore, the nature of the vulnerability is limited to denial-of-service attacks, which, although disruptive, do not inherently pose a direct risk of data compromise or system compromise. However, it\u0027s important to acknowledge that denial-of-service attacks can still have significant operational implications, particularly in environments reliant on continuous availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "RHBZ#2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52355"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/621",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/621"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T13:40:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM"
},
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T13:40:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.src",
"AppStream-10.0.Z.E2S:libtiff-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-devel-0:4.6.0-6.el10_0.4.x86_64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"AppStream-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debuginfo-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-debugsource-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-0:4.6.0-6.el10_0.4.x86_64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.aarch64",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.ppc64le",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.s390x",
"CRB-10.0.Z.E2S:libtiff-tools-debuginfo-0:4.6.0-6.el10_0.4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:50774
Vulnerability from csaf_redhat - Published: 2026-08-05 12:56 - Updated: 2026-08-13 22:34Summary
Red Hat Security Advisory: libtiff security update
Severity
Important
Notes
Topic: An update for libtiff is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libtiff is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50774",
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50774.json"
}
],
"title": "Red Hat Security Advisory: libtiff security update",
"tracking": {
"current_release_date": "2026-08-13T22:34:03+00:00",
"generator": {
"date": "2026-08-13T22:34:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:50774",
"initial_release_date": "2026-08-05T12:56:28+00:00",
"revision_history": [
{
"date": "2026-08-05T12:56:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-05T12:56:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:34:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product": {
"name": "Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.src",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.src",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-13.el9_6.6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-13.el9_6.6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-13.el9_6.6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-13.el9_6.6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"product": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"product_id": "libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-13.el9_6.6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"product": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"product_id": "libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-13.el9_6.6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.i686",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.i686",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"product": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"product_id": "libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-13.el9_6.6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"product": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"product_id": "libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-13.el9_6.6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product_id": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-13.el9_6.6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-13.el9_6.6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-13.el9_6.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-13.el9_6.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-13.el9_6.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-13.el9_6.6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"product": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"product_id": "libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-13.el9_6.6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libtiff-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff@4.4.0-13.el9_6.6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-devel@4.4.0-13.el9_6.6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debugsource@4.4.0-13.el9_6.6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-debuginfo@4.4.0-13.el9_6.6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools-debuginfo@4.4.0-13.el9_6.6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"product": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"product_id": "libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libtiff-tools@4.4.0-13.el9_6.6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686"
},
"product_reference": "libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-devel-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.9.6)",
"product_id": "CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
},
"product_reference": "libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"relates_to_product_reference": "CRB-9.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T12:56:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.src",
"AppStream-9.6.0.Z.EUS:libtiff-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-devel-0:4.4.0-13.el9_6.6.x86_64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.i686",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"AppStream-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debuginfo-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-debugsource-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-0:4.4.0-13.el9_6.6.x86_64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.aarch64",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.ppc64le",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.s390x",
"CRB-9.6.0.Z.EUS:libtiff-tools-debuginfo-0:4.4.0-13.el9_6.6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:54638
Vulnerability from csaf_redhat - Published: 2026-08-13 17:11 - Updated: 2026-08-13 22:35Summary
Red Hat Security Advisory: compat-libtiff3 security update
Severity
Important
Notes
Topic: An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64 | — |
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54638",
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54638.json"
}
],
"title": "Red Hat Security Advisory: compat-libtiff3 security update",
"tracking": {
"current_release_date": "2026-08-13T22:35:39+00:00",
"generator": {
"date": "2026-08-13T22:35:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:54638",
"initial_release_date": "2026-08-13T17:11:40+00:00",
"revision_history": [
{
"date": "2026-08-13T17:11:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-13T17:11:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:35:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_8.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_8.3?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_8.3?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_8.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_8.3?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_8.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_8.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64"
],
"known_not_affected": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T17:11:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.ppc64le",
"AppStream-8.8.0.Z.E4S:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.src",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_8.3.x86_64",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.i686",
"AppStream-8.8.0.Z.TUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_8.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:54640
Vulnerability from csaf_redhat - Published: 2026-08-13 16:40 - Updated: 2026-08-13 22:52Summary
Red Hat Security Advisory: compat-libtiff3 security update
Severity
Important
Notes
Topic: An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64 | — |
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54640",
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54640.json"
}
],
"title": "Red Hat Security Advisory: compat-libtiff3 security update",
"tracking": {
"current_release_date": "2026-08-13T22:52:40+00:00",
"generator": {
"date": "2026-08-13T22:52:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:54640",
"initial_release_date": "2026-08-13T16:40:52+00:00",
"revision_history": [
{
"date": "2026-08-13T16:40:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-13T16:40:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:52:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_6.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_6.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_6.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_6.3?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_6.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_6.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_6.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64"
],
"known_not_affected": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T16:40:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_6.3.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_6.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
RHSA-2026:54642
Vulnerability from csaf_redhat - Published: 2026-08-13 16:42 - Updated: 2026-08-13 22:52Summary
Red Hat Security Advisory: compat-libtiff3 security update
Severity
Important
Notes
Topic: An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.
Security Fix(es):
* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686 | — |
Workaround
|
|
| Unresolved product id: AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64 | — |
Workaround
|
Threats
Impact
Important
References
10 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF (Tagged Image File Format) image format files. This version should be used only if you are unable to use the current version of libtiff.\n\nSecurity Fix(es):\n\n* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54642",
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54642.json"
}
],
"title": "Red Hat Security Advisory: compat-libtiff3 security update",
"tracking": {
"current_release_date": "2026-08-13T22:52:41+00:00",
"generator": {
"date": "2026-08-13T22:52:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.15"
}
},
"id": "RHSA-2026:54642",
"initial_release_date": "2026-08-13T16:42:05+00:00",
"revision_history": [
{
"date": "2026-08-13T16:42:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-13T16:42:05+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-13T22:52:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_4.3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_4.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_4.3?arch=i686"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_4.3?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"product": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"product_id": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3@3.9.4-13.el8_4.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"product": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"product_id": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debugsource@3.9.4-13.el8_4.3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"product": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"product_id": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/compat-libtiff3-debuginfo@3.9.4-13.el8_4.3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
},
"product_reference": "compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64"
],
"known_not_affected": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-13T16:42:05+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.AUS:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debuginfo-0:3.9.4-13.el8_4.3.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:compat-libtiff3-debugsource-0:3.9.4-13.el8_4.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
}
]
}
ubuntu-cve-2026-12912
Vulnerability from osv_ubuntu
Published
2026-06-29 17:16
Modified
2026-07-01 21:19
Summary
Details
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
Severity
7.3 (High)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gdal-bin",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
},
{
"binary_name": "libgdal-java",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
},
{
"binary_name": "libgdal-perl",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
},
{
"binary_name": "libgdal1h",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
},
{
"binary_name": "python-gdal",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
},
{
"binary_name": "python3-gdal",
"binary_version": "1.10.1+dfsg-5ubuntu1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "gdal",
"purl": "pkg:deb/ubuntu/gdal@1.10.1+dfsg-5ubuntu1+esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.9.0-3.1ubuntu4",
"1.9.0-3.1ubuntu6",
"1.10.1+dfsg-2",
"1.10.1+dfsg-2build1",
"1.10.1+dfsg-3",
"1.10.1+dfsg-3build1",
"1.10.1+dfsg-3build2",
"1.10.1+dfsg-3ubuntu1",
"1.10.1+dfsg-3ubuntu2",
"1.10.1+dfsg-5ubuntu1",
"1.10.1+dfsg-5ubuntu1+esm1",
"1.10.1+dfsg-5ubuntu1+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.0.3-7ubuntu0.11+esm17"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.0.3-7ubuntu0.11+esm17"
},
{
"binary_name": "libtiff5",
"binary_version": "4.0.3-7ubuntu0.11+esm17"
},
{
"binary_name": "libtiffxx5",
"binary_version": "4.0.3-7ubuntu0.11+esm17"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.0.3-7ubuntu0.11+esm17?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.2-4ubuntu3",
"4.0.3-5ubuntu1",
"4.0.3-6",
"4.0.3-6ubuntu1",
"4.0.3-7",
"4.0.3-7ubuntu0.1",
"4.0.3-7ubuntu0.2",
"4.0.3-7ubuntu0.3",
"4.0.3-7ubuntu0.4",
"4.0.3-7ubuntu0.6",
"4.0.3-7ubuntu0.7",
"4.0.3-7ubuntu0.8",
"4.0.3-7ubuntu0.9",
"4.0.3-7ubuntu0.10",
"4.0.3-7ubuntu0.11",
"4.0.3-7ubuntu0.11+esm1",
"4.0.3-7ubuntu0.11+esm2",
"4.0.3-7ubuntu0.11+esm3",
"4.0.3-7ubuntu0.11+esm4",
"4.0.3-7ubuntu0.11+esm5",
"4.0.3-7ubuntu0.11+esm6",
"4.0.3-7ubuntu0.11+esm7",
"4.0.3-7ubuntu0.11+esm8",
"4.0.3-7ubuntu0.11+esm9",
"4.0.3-7ubuntu0.11+esm10",
"4.0.3-7ubuntu0.11+esm11",
"4.0.3-7ubuntu0.11+esm12",
"4.0.3-7ubuntu0.11+esm13",
"4.0.3-7ubuntu0.11+esm14",
"4.0.3-7ubuntu0.11+esm15",
"4.0.3-7ubuntu0.11+esm16",
"4.0.3-7ubuntu0.11+esm17"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.0.6-1ubuntu0.8+esm20"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.0.6-1ubuntu0.8+esm20"
},
{
"binary_name": "libtiff5",
"binary_version": "4.0.6-1ubuntu0.8+esm20"
},
{
"binary_name": "libtiffxx5",
"binary_version": "4.0.6-1ubuntu0.8+esm20"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.0.6-1ubuntu0.8+esm20?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.3-12.3ubuntu2",
"4.0.5-1",
"4.0.6-1",
"4.0.6-1ubuntu0.1",
"4.0.6-1ubuntu0.2",
"4.0.6-1ubuntu0.3",
"4.0.6-1ubuntu0.4",
"4.0.6-1ubuntu0.5",
"4.0.6-1ubuntu0.6",
"4.0.6-1ubuntu0.7",
"4.0.6-1ubuntu0.8",
"4.0.6-1ubuntu0.8+esm1",
"4.0.6-1ubuntu0.8+esm2",
"4.0.6-1ubuntu0.8+esm3",
"4.0.6-1ubuntu0.8+esm4",
"4.0.6-1ubuntu0.8+esm6",
"4.0.6-1ubuntu0.8+esm7",
"4.0.6-1ubuntu0.8+esm8",
"4.0.6-1ubuntu0.8+esm9",
"4.0.6-1ubuntu0.8+esm10",
"4.0.6-1ubuntu0.8+esm11",
"4.0.6-1ubuntu0.8+esm12",
"4.0.6-1ubuntu0.8+esm13",
"4.0.6-1ubuntu0.8+esm14",
"4.0.6-1ubuntu0.8+esm15",
"4.0.6-1ubuntu0.8+esm16",
"4.0.6-1ubuntu0.8+esm17",
"4.0.6-1ubuntu0.8+esm18",
"4.0.6-1ubuntu0.8+esm19",
"4.0.6-1ubuntu0.8+esm20"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gdal-bin",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libgdal-java",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libgdal-perl",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libgdal1i",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "python-gdal",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "python3-gdal",
"binary_version": "1.11.3+dfsg-3ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "gdal",
"purl": "pkg:deb/ubuntu/gdal@1.11.3+dfsg-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.11.2+dfsg-3ubuntu3",
"1.11.2+dfsg-3ubuntu4",
"1.11.3+dfsg-2build1",
"1.11.3+dfsg-2build2",
"1.11.3+dfsg-2build3",
"1.11.3+dfsg-3",
"1.11.3+dfsg-3build1",
"1.11.3+dfsg-3build2",
"1.11.3+dfsg-3ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.0.9-5ubuntu0.10+esm10"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.0.9-5ubuntu0.10+esm10"
},
{
"binary_name": "libtiff5",
"binary_version": "4.0.9-5ubuntu0.10+esm10"
},
{
"binary_name": "libtiffxx5",
"binary_version": "4.0.9-5ubuntu0.10+esm10"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.0.9-5ubuntu0.10+esm10?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.8-5",
"4.0.8-6",
"4.0.9-1",
"4.0.9-2",
"4.0.9-3",
"4.0.9-4",
"4.0.9-4ubuntu1",
"4.0.9-5",
"4.0.9-5ubuntu0.1",
"4.0.9-5ubuntu0.2",
"4.0.9-5ubuntu0.3",
"4.0.9-5ubuntu0.4",
"4.0.9-5ubuntu0.5",
"4.0.9-5ubuntu0.6",
"4.0.9-5ubuntu0.7",
"4.0.9-5ubuntu0.8",
"4.0.9-5ubuntu0.9",
"4.0.9-5ubuntu0.10",
"4.0.9-5ubuntu0.10+esm1",
"4.0.9-5ubuntu0.10+esm2",
"4.0.9-5ubuntu0.10+esm3",
"4.0.9-5ubuntu0.10+esm4",
"4.0.9-5ubuntu0.10+esm5",
"4.0.9-5ubuntu0.10+esm6",
"4.0.9-5ubuntu0.10+esm7",
"4.0.9-5ubuntu0.10+esm8",
"4.0.9-5ubuntu0.10+esm9",
"4.0.9-5ubuntu0.10+esm10"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "neuron",
"binary_version": "7.5-1"
},
{
"binary_name": "python3-neuron",
"binary_version": "7.5-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "neuron",
"purl": "pkg:deb/ubuntu/neuron@7.5-1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.5-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.9.5+dfsg-0ubuntu2+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.9.5+dfsg-0ubuntu2+esm1?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.9.1+dfsg-4",
"5.9.1+dfsg-4ubuntu1",
"5.9.2+dfsg-2ubuntu1",
"5.9.3+dfsg-0ubuntu1",
"5.9.4+dfsg-0ubuntu1",
"5.9.5+dfsg-0ubuntu2",
"5.9.5+dfsg-0ubuntu2+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "texmaker",
"binary_version": "5.0.2-1ubuntu0.1~esm1"
},
{
"binary_name": "texmaker-data",
"binary_version": "5.0.2-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "texmaker",
"purl": "pkg:deb/ubuntu/texmaker@5.0.2-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.5-1",
"5.0.2-1",
"5.0.2-1build1",
"5.0.2-1build2",
"5.0.2-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.1.0+git191117-2ubuntu0.20.04.14+esm3"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.1.0+git191117-2ubuntu0.20.04.14+esm3"
},
{
"binary_name": "libtiff5",
"binary_version": "4.1.0+git191117-2ubuntu0.20.04.14+esm3"
},
{
"binary_name": "libtiffxx5",
"binary_version": "4.1.0+git191117-2ubuntu0.20.04.14+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.1.0+git191117-2ubuntu0.20.04.14+esm3?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.10+git191003-1",
"4.1.0+git191117-1",
"4.1.0+git191117-2",
"4.1.0+git191117-2build1",
"4.1.0+git191117-2ubuntu0.20.04.1",
"4.1.0+git191117-2ubuntu0.20.04.2",
"4.1.0+git191117-2ubuntu0.20.04.3",
"4.1.0+git191117-2ubuntu0.20.04.4",
"4.1.0+git191117-2ubuntu0.20.04.5",
"4.1.0+git191117-2ubuntu0.20.04.6",
"4.1.0+git191117-2ubuntu0.20.04.7",
"4.1.0+git191117-2ubuntu0.20.04.8",
"4.1.0+git191117-2ubuntu0.20.04.9",
"4.1.0+git191117-2ubuntu0.20.04.10",
"4.1.0+git191117-2ubuntu0.20.04.11",
"4.1.0+git191117-2ubuntu0.20.04.12",
"4.1.0+git191117-2ubuntu0.20.04.13",
"4.1.0+git191117-2ubuntu0.20.04.14",
"4.1.0+git191117-2ubuntu0.20.04.14+esm1",
"4.1.0+git191117-2ubuntu0.20.04.14+esm2",
"4.1.0+git191117-2ubuntu0.20.04.14+esm3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "neuron",
"binary_version": "7.6.3-1build4"
},
{
"binary_name": "python3-neuron",
"binary_version": "7.6.3-1build4"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "neuron",
"purl": "pkg:deb/ubuntu/neuron@7.6.3-1build4?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.6.3-1build2",
"7.6.3-1build3",
"7.6.3-1build4"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.12.8+dfsg-0ubuntu1.1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.12.8+dfsg-0ubuntu1.1+esm1?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.12.4+dfsg-1ubuntu1",
"5.12.4+dfsg-1ubuntu3",
"5.12.5+dfsg-3ubuntu1",
"5.12.5+dfsg-6ubuntu2",
"5.12.5+dfsg-7",
"5.12.5+dfsg-7build1",
"5.12.8+dfsg-0ubuntu1",
"5.12.8+dfsg-0ubuntu1.1",
"5.12.8+dfsg-0ubuntu1.1+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "texmaker",
"binary_version": "5.0.3-1ubuntu0.20.04.1~esm1"
},
{
"binary_name": "texmaker-data",
"binary_version": "5.0.3-1ubuntu0.20.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "texmaker",
"purl": "pkg:deb/ubuntu/texmaker@5.0.3-1ubuntu0.20.04.1~esm1?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.3-1build2",
"5.0.3-1build3",
"5.0.3-1build4",
"5.0.3-1build5",
"5.0.3-1ubuntu0.20.04.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "neuron",
"binary_version": "7.6.3-1build6"
},
{
"binary_name": "python3-neuron",
"binary_version": "7.6.3-1build6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "neuron",
"purl": "pkg:deb/ubuntu/neuron@7.6.3-1build6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.6.3-1build5",
"7.6.3-1build6"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.3.0-6ubuntu0.13"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.3.0-6ubuntu0.13"
},
{
"binary_name": "libtiff5",
"binary_version": "4.3.0-6ubuntu0.13"
},
{
"binary_name": "libtiffxx5",
"binary_version": "4.3.0-6ubuntu0.13"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.3.0-6ubuntu0.13?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.3.0-1",
"4.3.0-2",
"4.3.0-3",
"4.3.0-3build1",
"4.3.0-4",
"4.3.0-5",
"4.3.0-6",
"4.3.0-6ubuntu0.1",
"4.3.0-6ubuntu0.2",
"4.3.0-6ubuntu0.3",
"4.3.0-6ubuntu0.4",
"4.3.0-6ubuntu0.5",
"4.3.0-6ubuntu0.6",
"4.3.0-6ubuntu0.7",
"4.3.0-6ubuntu0.8",
"4.3.0-6ubuntu0.9",
"4.3.0-6ubuntu0.10",
"4.3.0-6ubuntu0.11",
"4.3.0-6ubuntu0.12",
"4.3.0-6ubuntu0.13"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5pdf5",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "libqt5pdfwidgets5",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qml-module-qtquick-pdf",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qt5-image-formats-plugin-pdf",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qtpdf5-doc-html",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qtpdf5-examples",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.15.9+dfsg-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.15.9+dfsg-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.15.6+dfsg-1",
"5.15.6+dfsg-2",
"5.15.7+dfsg-2",
"5.15.8+dfsg-1",
"5.15.8+dfsg-1build1",
"5.15.8+dfsg-1build2",
"5.15.8+dfsg-2",
"5.15.9+dfsg-1",
"5.15.9+dfsg-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "texmaker",
"binary_version": "5.0.3-1ubuntu0.22.04.1~esm1"
},
{
"binary_name": "texmaker-data",
"binary_version": "5.0.3-1ubuntu0.22.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "texmaker",
"purl": "pkg:deb/ubuntu/texmaker@5.0.3-1ubuntu0.22.04.1~esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.3-1build8",
"5.0.3-1build9",
"5.0.3-1ubuntu0.22.04.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.5.1+git230720-4ubuntu2.5"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.5.1+git230720-4ubuntu2.5"
},
{
"binary_name": "libtiff6",
"binary_version": "4.5.1+git230720-4ubuntu2.5"
},
{
"binary_name": "libtiffxx6",
"binary_version": "4.5.1+git230720-4ubuntu2.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.5.1+git230720-4ubuntu2.5?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.5.1+git230720-1ubuntu1",
"4.5.1+git230720-3ubuntu1",
"4.5.1+git230720-4ubuntu1",
"4.5.1+git230720-4ubuntu2",
"4.5.1+git230720-4ubuntu2.1",
"4.5.1+git230720-4ubuntu2.2",
"4.5.1+git230720-4ubuntu2.3",
"4.5.1+git230720-4ubuntu2.4",
"4.5.1+git230720-4ubuntu2.5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5pdf5",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libqt5pdfwidgets5",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qml-module-qtquick-pdf",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qt5-image-formats-plugin-pdf",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qtpdf5-doc-html",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qtpdf5-examples",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.15.16+dfsg-3ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.15.16+dfsg-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.15.15+dfsg-2",
"5.15.15+dfsg-2build2",
"5.15.15+dfsg-2ubuntu1",
"5.15.16+dfsg-1",
"5.15.16+dfsg-1ubuntu2",
"5.15.16+dfsg-1ubuntu4",
"5.15.16+dfsg-3",
"5.15.16+dfsg-3ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "texmaker",
"binary_version": "5.1.3+dfsg-1ubuntu0.1~esm1"
},
{
"binary_name": "texmaker-data",
"binary_version": "5.1.3+dfsg-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "texmaker",
"purl": "pkg:deb/ubuntu/texmaker@5.1.3+dfsg-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.1.3+dfsg-1build4",
"5.1.3+dfsg-1build5",
"5.1.3+dfsg-1build6",
"5.1.3+dfsg-1build7",
"5.1.3+dfsg-1build8",
"5.1.3+dfsg-1ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5pdf5",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "libqt5pdfwidgets5",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qml-module-qtquick-pdf",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qt5-image-formats-plugin-pdf",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qtpdf5-doc-html",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qtpdf5-examples",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.15.19+dfsg2-1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.15.19+dfsg2-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.15.19+dfsg2-1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.15.18+dfsg-2",
"5.15.18+dfsg-2build1",
"5.15.19+dfsg-1",
"5.15.19+dfsg2-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "texmaker",
"binary_version": "5.1.3+dfsg-3build1"
},
{
"binary_name": "texmaker-data",
"binary_version": "5.1.3+dfsg-3build1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "texmaker",
"purl": "pkg:deb/ubuntu/texmaker@5.1.3+dfsg-3build1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.1.3+dfsg-3",
"5.1.3+dfsg-3build1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.7.0-3ubuntu3.1"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.7.0-3ubuntu3.1"
},
{
"binary_name": "libtiff6",
"binary_version": "4.7.0-3ubuntu3.1"
},
{
"binary_name": "libtiffxx6",
"binary_version": "4.7.0-3ubuntu3.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.7.0-3ubuntu3.1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.5.1+git230720-4ubuntu4",
"4.7.0-3ubuntu1",
"4.7.0-3ubuntu2",
"4.7.0-3ubuntu3",
"4.7.0-3ubuntu3.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtiff-opengl",
"binary_version": "4.7.0-3ubuntu4"
},
{
"binary_name": "libtiff-tools",
"binary_version": "4.7.0-3ubuntu4"
},
{
"binary_name": "libtiff6",
"binary_version": "4.7.0-3ubuntu4"
},
{
"binary_name": "libtiffxx6",
"binary_version": "4.7.0-3ubuntu4"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "tiff",
"purl": "pkg:deb/ubuntu/tiff@4.7.0-3ubuntu4?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.7.0-3ubuntu3",
"4.7.0-3ubuntu4"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webengine-data",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webengine5",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginecore5",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "libqt5webenginewidgets5",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "qml-module-qtwebengine",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-dev-tools",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-doc-html",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
},
{
"binary_name": "qtwebengine5-examples",
"binary_version": "5.15.19+dfsg2-4ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:26.04:LTS",
"name": "qtwebengine-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebengine-opensource-src@5.15.19+dfsg2-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.15.19+dfsg2-1",
"5.15.19+dfsg2-1build1",
"5.15.19+dfsg2-2",
"5.15.19+dfsg2-3",
"5.15.19+dfsg2-4",
"5.15.19+dfsg2-4ubuntu0.1~esm1"
]
}
],
"aliases": [],
"details": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"id": "UBUNTU-CVE-2026-12912",
"modified": "2026-07-01T21:19:39Z",
"published": "2026-06-29T17:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-12912"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/ba2b04b114c5dd945107ccc613cedfcca3af73bb"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/51fa6dfe93f20da0d38f079fbc61c7c960bcbc16"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/828"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/883"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/f9bda11bf2fc819b971517582666d56f18b1bc3f"
},
{
"type": "REPORT",
"url": "https://gitlab.com/libtiff/libtiff/-/commit/90601d9a23382d98f3695ec14441145c37a77574"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"type": "REPORT",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-12912"
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…