[AutoPR- Security] Patch libtiff for CVE-2025-9165, CVE-2025-8851 [MEDIUM] (#14555)

Author: azurelinux-security

SPECS/libtiff/CVE-2025-8851.patch

@@ -0,0 +1,70 @@
+From df579d63e4152d3ae76d1c7979774295a7b9f174 Mon Sep 17 00:00:00 2001
+From: Lee Howard <faxguy@howardsilvan.com>
+Date: Sun, 11 Aug 2024 16:01:07 +0000
+Subject: [PATCH] Attempt to address tiffcrop Coverity scan issues 1605444,
+ 1605445, and 1605449.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3.patch
+---
+ archive/tools/tiffcrop.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/archive/tools/tiffcrop.c b/archive/tools/tiffcrop.c
+index d3365de..93f0779 100644
+--- a/archive/tools/tiffcrop.c
++++ b/archive/tools/tiffcrop.c
+@@ -5573,7 +5573,14 @@ static int readSeparateStripsIntoBuffer(TIFF *in, uint8_t *obuf,
+             buff = srcbuffs[s];
+             strip = (s * strips_per_sample) + j;
+             bytes_read = TIFFReadEncodedStrip(in, strip, buff, stripsize);
+-            rows_this_strip = (uint32_t)(bytes_read / src_rowsize);
++            if (bytes_read < 0)
++            {
++                rows_this_strip = 0;
++            }
++            else
++            {
++                rows_this_strip = (uint32_t)(bytes_read / src_rowsize);
++            }
+             if (bytes_read < 0 && !ignore)
+             {
+                 TIFFError(TIFFFileName(in),
+@@ -6002,7 +6009,7 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
+             rmargin = _TIFFClampDoubleToUInt32(crop->margins[3] * scale * xres);
+         }
+ 
+-        if ((lmargin + rmargin) > image->width)
++        if (lmargin == 0xFFFFFFFFU || rmargin == 0xFFFFFFFFU || (lmargin + rmargin) > image->width)
+         {
+             TIFFError("computeInputPixelOffsets",
+                       "Combined left and right margins exceed image width");
+@@ -6010,7 +6017,7 @@ static int computeInputPixelOffsets(struct crop_mask *crop,
+             rmargin = (uint32_t)0;
+             return (-1);
+         }
+-        if ((tmargin + bmargin) > image->length)
++        if (tmargin == 0xFFFFFFFFU || bmargin == 0xFFFFFFFFU || (tmargin + bmargin) > image->length)
+         {
+             TIFFError("computeInputPixelOffsets",
+                       "Combined top and bottom margins exceed image length");
+@@ -6592,14 +6599,14 @@ static int computeOutputPixelOffsets(struct crop_mask *crop,
+                                                ((image->bps + 7) / 8));
+         }
+ 
+-        if ((hmargin * 2.0) > (pwidth * page->hres))
++        if (hmargin == 0xFFFFFFFFU || (hmargin * 2.0) > (pwidth * page->hres))
+         {
+             TIFFError("computeOutputPixelOffsets",
+                       "Combined left and right margins exceed page width");
+             hmargin = (uint32_t)0;
+             return (-1);
+         }
+-        if ((vmargin * 2.0) > (plength * page->vres))
++        if (vmargin == 0xFFFFFFFFU || (vmargin * 2.0) > (plength * page->vres))
+         {
+             TIFFError("computeOutputPixelOffsets",
+                       "Combined top and bottom margins exceed page length");
+-- 
+2.45.4
+

SPECS/libtiff/CVE-2025-9165.patch

@@ -0,0 +1,31 @@
+From 735cd19c9df0aca080c864aa8be354b11241c987 Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Fri, 8 Aug 2025 21:35:30 +0200
+Subject: [PATCH] tiffcmp: fix memory leak when second file cannot be opened.
+
+Closes #728, #729
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0.patch
+---
+ archive/tools/tiffcmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/archive/tools/tiffcmp.c b/archive/tools/tiffcmp.c
+index 529c1cd..88d9470 100644
+--- a/archive/tools/tiffcmp.c
++++ b/archive/tools/tiffcmp.c
+@@ -105,7 +105,10 @@ int main(int argc, char *argv[])
+         return (2);
+     tif2 = TIFFOpen(argv[optind + 1], "r");
+     if (tif2 == NULL)
++    {
++        TIFFClose(tif1);
+         return (2);
++    }
+     dirnum = 0;
+     while (tiffcmp(tif1, tif2))
+     {
+-- 
+2.45.4
+

SPECS/libtiff/libtiff.spec

@@ -1,7 +1,7 @@
 Summary:        TIFF libraries and associated utilities.
 Name:           libtiff
 Version:        4.6.0
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        libtiff
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -16,6 +16,8 @@ Patch4:         CVE-2023-6228.patch
 Patch5:         CVE-2025-8176.patch
 Patch6:         CVE-2025-8177.patch
 Patch7:         CVE-2025-8534.patch
+Patch8:         CVE-2025-8851.patch
+Patch9:         CVE-2025-9165.patch
 BuildRequires:  autoconf
 BuildRequires:  automake
 BuildRequires:  libjpeg-turbo-devel
@@ -68,6 +70,9 @@ make %{?_smp_mflags} -k check
 %{_docdir}/*
 
 %changelog
+* Thu Aug 21 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.6.0-8
+- Patch for CVE-2025-9165, CVE-2025-8851
+
 * Wed Aug 06 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.6.0-7
 - Patch for CVE-2025-8534, CVE-2025-8177, CVE-2025-8176