From 3db725d71d3220bf62a1352ef9bc6312f89499ef Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 6 Aug 2025 22:20:29 +0200 Subject: [PATCH] package/tiff: add patch to fix CVE-2025-8177 Fix the following vulnerability: - CVE-2025-8177 A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-8177 - https://gitlab.com/libtiff/libtiff/-/merge_requests/737 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- .../tiff/0004-fix-for-thumbnail-issue.patch | 35 +++++++++++++++++++ package/tiff/tiff.mk | 3 ++ 2 files changed, 38 insertions(+) create mode 100644 package/tiff/0004-fix-for-thumbnail-issue.patch diff --git a/package/tiff/0004-fix-for-thumbnail-issue.patch b/package/tiff/0004-fix-for-thumbnail-issue.patch new file mode 100644 index 0000000000..237306f6c2 --- /dev/null +++ b/package/tiff/0004-fix-for-thumbnail-issue.patch @@ -0,0 +1,35 @@ +From e8de4dc1f923576dce9d625caeebd93f9db697e1 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Wed, 25 Jun 2025 17:14:18 +0000 +Subject: [PATCH] Fix for thumbnail issue #715 + +CVE: CVE-2025-8177 +Upstream: https://gitlab.com/libtiff/libtiff/-/commit/e8de4dc1f923576dce9d625caeebd93f9db697e1 +Signed-off-by: Thomas Perale +--- + tools/thumbnail.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/tools/thumbnail.c b/tools/thumbnail.c +index 9cade913..7e21f521 100644 +--- a/tools/thumbnail.c ++++ b/tools/thumbnail.c +@@ -620,7 +620,15 @@ static void setrow(uint8_t *row, uint32_t nrows, const uint8_t *rows[]) + } + acc += bits[*src & mask1]; + } +- *row++ = cmap[(255 * acc) / area]; ++ if (255 * acc / area < 256) ++ { ++ *row++ = cmap[(255 * acc) / area]; ++ } ++ else ++ { ++ fprintf(stderr, "acc=%d, area=%d\n", acc, area); ++ *row++ = cmap[0]; ++ } + } + } + +-- +GitLab diff --git a/package/tiff/tiff.mk b/package/tiff/tiff.mk index bd95fdca7f..3d426fad4d 100644 --- a/package/tiff/tiff.mk +++ b/package/tiff/tiff.mk @@ -16,6 +16,9 @@ TIFF_INSTALL_STAGING = YES # 0001-don-t-skip-the-first-line-of-the-input-image.patch, 0002-fix-tiffmedian-bug.patch, 0003-conflict-resolution.patch TIFF_IGNORE_CVES += CVE-2025-8176 +# 0004-fix-for-thumbnail-issue.patch +TIFF_IGNORE_CVES += CVE-2025-8177 + # webp has a (optional) dependency on tiff, so we can't have webp # support in tiff, or that would create a circular dependency. TIFF_CONF_OPTS = \