tiff (4.7.1-2ubuntu1) stonking; urgency=medium

  * Merge from Debian unstable (LP: #2153363). Remaining changes:
    - Don't build with LERC on i386 because it requires numpy (Closes: #1017958)
  * Drop Changes:
    - d/p/CVE-2025-8176.patch: fix heap use-after-free in tiffmedian
      [Fixed in 4.7.1]
    - d/p/CVE-2025-8534.patch: tiff2ps: check return of TIFFGetFiled() to fix
      [Fixed in 4.7.1]
    - d/p/CVE-2025-8961.patch: Add _TIFFfree and extra read_buff check
      in tools/tiffcrop.c.
      [Fixed in 4.7.1]
    - d/p/CVE-2025-9165.patch: Add TIFFClose in tools/tiffcmp.c.
      [Fixed in 4.7.1]
    - d/p/CVE-2025-9900.patch: Add img->height and img->width checks
      in libtiff/tif_getimage.c.
      [Fixed in 4.7.1]

 -- Simon Poirier <simon.poirier@canonical.com>  Thu, 21 May 2026 11:46:25 -0400

tiff (4.7.1-2) unstable; urgency=high

  * Backport security fix for CVE-2026-4775, signed integer overflow
    vulnerability in putcontig8bitYCbCr44tile() (closes: #1132632).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 04 Apr 2026 09:11:56 +0200

tiff (4.7.1-1) unstable; urgency=medium

  * New upstream release.
  * Update libtiff6 symbols.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 21 Sep 2025 14:39:50 +0200

tiff (4.7.0-5) unstable; urgency=high

  * Backport security fix for CVE-2025-8961, double free and memory leak in
    the tiffcrop tool (closes: #1111317).
  * Update watch file.
  * Update Standards-Version to 4.7.2 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 10 Sep 2025 16:53:31 +0200

tiff (4.7.0-4) unstable; urgency=high

  * Backport security fix for CVE-2025-9165, tiffcmp memory leak when second
    file cannot be opened (closes: #1111878).
  * Backport security fix for CVE-2024-13978, potential division-by-zero in
    the tiff2pdf tool (closes: #1111323).
  * Fix fax2ps regression where TIFFTAG_FAXFILLFUNC is being used rather than
    an output buffer.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 24 Aug 2025 11:28:17 +0200

tiff (4.7.0-3ubuntu4) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@debian.org>  Mon, 02 Feb 2026 21:49:08 +0100

tiff (4.7.0-3ubuntu3) questing; urgency=medium

  * SECURITY UPDATE: Memory corruption.
    - debian/patches/CVE-2025-8961.patch: Add _TIFFfree and extra read_buff
      check in tools/tiffcrop.c.
    - CVE-2025-8961
  * SECURITY UPDATE: Memory leak.
    - debian/patches/CVE-2025-9165.patch: Add TIFFClose in tools/tiffcmp.c.
    - CVE-2025-9165
  * SECURITY UPDATE: Out of bounds write when processing specially crafted
    TIFF files.
    - debian/patches/CVE-2025-9900.patch: Add img->height and img->width
      checks in libtiff/tif_getimage.c.
    - CVE-2025-9900

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 29 Sep 2025 11:21:14 -0230

tiff (4.7.0-3ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: null-pointer dereference
    - d/p/CVE-2024-13978.patch: fix in fax2ps caused by regression where
      TIFFTAG_FAXFILLFUNC is being used rather than an output buffer.
    - d/p/CVE-2025-8534.patch: tiff2ps: check return of TIFFGetFiled() to
      fix
    - CVE-2024-13978
    - CVE-2025-8534
  * SECURITY UPDATE: use-after-free issue
    - d/p/CVE-2025-8176.patch: fix heap use-after-free in tiffmedian
    - CVE-2025-8176

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 20 Aug 2025 15:42:44 +0530

tiff (4.7.0-3ubuntu1) questing; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - Don't build with LERC on i386 because it requires numpy (Closes: #1017958)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 30 Apr 2025 14:29:33 -0400

tiff (4.7.0-3) unstable; urgency=medium

  [ Santiago Vila <sanvila@debian.org> ]
  * Do not run tests in parallel (closes: #1102073).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 05 Apr 2025 07:48:49 +0200

tiff (4.7.0-2) unstable; urgency=medium

  * Backport upstream fix for test_directory.c not to fail on big-endian
    machines.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 28 Mar 2025 07:08:13 +0100

tiff (4.7.0-1) unstable; urgency=medium

  * New upstream release.
  * Update libtiff6 symbols.
  * Update watch file.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 27 Mar 2025 13:27:57 +0100

tiff (4.5.1+git230720-5) unstable; urgency=high

  * Backport security fix for CVE-2024-7006, NULL pointer dereference bug in
    _TIFFMergeFields() (closes: #1078648).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 15 Aug 2024 18:04:20 +0200

tiff (4.5.1+git230720-4) unstable; urgency=high

  * Backport security fix for CVE-2023-52355, an out-of-memory flaw that
    could be triggered by passing a crafted tiff file with documentation
    update how to prevent it.
  * Backport security fix for CVE-2023-52356, a segment fault flaw that
    could be triggered by passing a crafted tiff file (closes: #1061524).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 27 Jan 2024 10:32:25 +0100

tiff (4.5.1+git230720-3) unstable; urgency=medium

  * Mark break on versions of libimager-perl that don't work with this tiff
    version (closes: #1057326).
  * Update Standards-Version to 4.6.2 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 03 Dec 2023 15:16:24 +0100

tiff (4.5.1+git230720-2) unstable; urgency=high

  * Backport security fix for CVE-2023-6277, passing a crafted tiff file to
    TIFFOpen() API may allow a remote attacker to cause a denial of service
    (closes: #1056751).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 26 Nov 2023 10:25:48 +0100

tiff (4.5.1+git230720-1) unstable; urgency=medium

  * Git snapshot, fixing the following security issues:
    - fix TransferFunction writing of only two transfer functions,
    - TIFFReadDirectory(): fix crash when reading tag TIFFTAG_EP_BATTERYLEVEL,
    - WebP decoder: validate WebP blob width, height, band count against
      TIFF parameters,
    - TIFFReadDirectoryCheckOrder(): avoid integer overflow,
    - tiffcp: fix memory corruption (overflow) on hostile images,
    - raw2tiff: fix integer overflow and bypass of the check.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 29 Jul 2023 23:36:42 +0200

tiff (4.5.1-1) unstable; urgency=medium

  * New upstream release.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Wed, 21 Jun 2023 17:49:37 +0200

tiff (4.5.1~rc3-1) unstable; urgency=medium

  * New upstream release candidate version.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Mon, 12 Jun 2023 21:56:31 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtiff-doc`.
