Changelog for libtiff5-4.0.7-116.1.x86_64.rpm :
Thu Feb 2 13:00:00 2017 fstrbaAATTsuse.com
- Added patch:

* tiff-4.0.7-TIFFTAG_FAXRECVPARAMS.patch
- Fix a regression introduced in 4.0.7 (bsc#1022103)
- http://bugzilla.maptools.org/show_bug.cgi?id=2636

Fri Jan 13 13:00:00 2017 fstrbaAATTsuse.com
- Added patch:

* tiff-4.0.7-CVE-2017-5225.patch
- Upstream fix for CVE-2017-5225, bsc#1019611: heap buffer
overflow in tools/tiffcp via a crafted BitsPerSample value

Mon Dec 19 13:00:00 2016 jengelhAATTinai.de
- Drop --with-pic, this is only for static libs (which are not built)
- Update descriptions

Mon Dec 19 13:00:00 2016 idonmezAATTsuse.com
- Update homepage

Tue Nov 29 13:00:00 2016 fstrbaAATTsuse.com
- Upgrade to upstream release 4.0.7

* libtiff/tif_aux.c
+ Fix crash in TIFFVGetFieldDefaulted() when requesting
Predictor tag and that the zip/lzw codec is not configured.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591

* libtiff/tif_compress.c
+ Make TIFFNoDecode() return 0 to indicate an error and make
upper level read routines treat it accordingly. (linked to the
test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)

* libtiff/tif_dir.c
+ Discard values of SMinSampleValue and SMaxSampleValue when
they have been read and the value of SamplesPerPixel is
changed afterwards (like when reading a OJPEG compressed image
with a missing SamplesPerPixel tag, and whose photometric is
RGB or YCbCr, forcing SamplesPerPixel being 3). Otherwise when
rewriting the directory (for example with tiffset, we will
expect 3 values whereas the array had been allocated with just
one), thus causing a out of bound read access. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2500
(CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658, bsc#974840)

* libtiff/tif_dirread.c
+ In TIFFFetchNormalTag(), do not dereference NULL pointer when
values of tags with TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII
access are 0-byte arrays. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression
introduced by previous fix done on 2016-11-11 for
CVE-2016-9297, bsc#1010161). Assigned as CVE-2016-9448,
bsc#1011103
+ In TIFFFetchNormalTag(), make sure that values of tags with
TIFF_SETGET_C16_ASCII/TIFF_SETGET_C32_ASCII access are null
terminated, to avoid potential read outside buffer in
_TIFFPrintField(). Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2590
(CVE-2016-9297, bsc#1010161)
+ Initialize doubledata at line 3693 to NULL to please MSVC 2013
+ Prevent reading ColorMap or TransferFunction if
BitsPerPixel > 24, so as to avoid huge memory allocation and
file read attempts
+ Reject images with OJPEG compression that have no
TileOffsets/StripOffsets tag, when OJPEG compression is
disabled. Prevent null pointer dereference in
TIFFReadRawStrip1() and other functions that expect
td_stripbytecount to be non NULL. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2585
+ When compiled with DEFER_STRILE_LOAD, fix regression, when
reading a one-strip file without a StripByteCounts tag.
+ Workaround false positive warning of Clang Static Analyzer
about null pointer dereference in TIFFCheckDirOffset().

* libtiff/tif_dirwrite.c
+ Avoid null pointer dereference on td_stripoffset when writing
directory, if FIELD_STRIPOFFSETS was artificially set for a
hack case in OJPEG case. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2500
(CVE-2014-8127, bsc#914890, duplicate: CVE-2016-3658,
bsc#974840)
+ Fix truncation to 32 bit of file offsets in TIFFLinkDirectory()
and TIFFWriteDirectorySec() when aligning directory offsets on
an even offset (affects BigTIFF).

* libtiff/tif_dumpmode.c
+ DumpModeEncode() should return 0 in case of failure so that
the above mentionned functions detect the error.

* libtiff/tif_fax3.c
+ remove dead assignment in Fax3PutEOLgdal().

* libtiff/tif_fax3.h
+ make Param member of TIFFFaxTabEnt structure a uint16 to
reduce size of the binary.

* libtiff/tif_getimage.c
+ Fix out-of-bound reads in TIFFRGBAImage interface in case of
unsupported values of SamplesPerPixel/ExtraSamples for
LogLUV/CIELab. Add explicit call to TIFFRGBAImageOK() in
TIFFRGBAImageBegin(). Fix CVE-2015-8665 and CVE-2015-8683.
+ Fix some benign warnings which appear in 64-bit compilation
under Microsoft Visual Studio of the form \"Arithmetic
overflow: 32-bit value is shifted, then cast to 64-bit value.
Results might not be an expected value.\"
+ TIFFRGBAImageOK: Reject attempts to read floating point images.

* libtiff/tif_luv.c
+ Fix potential out-of-bound writes in decode functions in non
debug builds by replacing assert()s by regular if checks
(http://bugzilla.maptools.org/show_bug.cgi?id=2522). Fix
potential out-of-bound reads in case of short input data.
+ Validate that for COMPRESSION_SGILOG and PHOTOMETRIC_LOGL,
there is only one sample per pixel. Avoid potential invalid
memory write on corrupted/unexpected images when using the
TIFFRGBAImageBegin() interface

* libtiff/tif_next.c
+ Fix potential out-of-bound write in NeXTDecode()
(http://bugzilla.maptools.org/show_bug.cgi?id=2508)

* libtiff/tif_pixarlog.c
+ Avoid zlib error messages to pass a NULL string to %s
formatter, which is undefined behaviour in sprintf().
+ Fix out-of-bounds write vulnerabilities in heap allocated
buffers. Reported as MSVR 35094.
+ Fix potential buffer write overrun in PixarLogDecode() on
corrupted/unexpected images (CVE-2016-5875, bsc#987351)
+ Fix write buffer overflow in PixarLogEncode if more input
samples are provided than expected by PixarLogSetupEncode.
Idea based on libtiff-CVE-2016-3990.patch from
libtiff-4.0.3-25.el7_2.src.rpm, but with different and simpler
check. (http://bugzilla.maptools.org/show_bug.cgi?id=2544,
bsc#975069)

* libtiff/tif_predict.c
+ PredictorSetup: Enforce bits-per-sample requirements of
floating point predictor (3). Fixes CVE-2016-3622 \"Divide By
Zero in the tiff2rgba tool.\" (bsc#974449)

* libtiff/tif_predict.h, libtiff/tif_predict.c
+ Replace assertions by runtime checks to avoid assertions in
debug mode, or buffer overflows in release mode. Can happen
when dealing with unusual tile size like YCbCr with
subsampling. Reported as MSVR 35105.

* libtiff/tif_read.c
+ Fix out-of-bounds read on memory-mapped files in
TIFFReadRawStrip1() and TIFFReadRawTile1() when stripoffset
is beyond tmsize_t max value
+ Make TIFFReadEncodedStrip() and TIFFReadEncodedTile() directly
use user provided buffer when no compression (and other
conditions) to save a memcpy().

* libtiff/tif_strip.c
+ Make TIFFNumberOfStrips() return the td->td_nstrips value when
it is non-zero, instead of recomputing it. This is needed in
TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read
outsize of array in tiffsplit (or other utilities using
TIFFNumberOfStrips()). Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2587
(CVE-2016-9273, bsc#1010163)

* libtiff/tif_write.c
+ Fix issue in error code path of TIFFFlushData1() that didn\'t
reset the tif_rawcc and tif_rawcp members. I\'m not completely
sure if that could happen in practice outside of the odd
behaviour of t2p_seekproc() of tiff2pdf). The report points
that a better fix could be to check the return value of
TIFFFlushData1() in places where it isn\'t done currently, but
it seems this patch is enough. Reported as MSVR 35095.
+ Make TIFFWriteEncodedStrip() and TIFFWriteEncodedTile()
directly use user provided buffer when no compression to save
a memcpy().
+ TIFFWriteEncodedStrip() and TIFFWriteEncodedTile() should
return -1 in case of failure of tif_encodestrip() as documented

* tools/fax2tiff.c
+ Fix segfault when specifying -r without argument. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2572

* tools/Makefile.am
+ The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff,
sgisv, and ycbcr are completely removed from the distribution.
The libtiff tools rgb2ycbcr and thumbnail are only built in
the build tree for testing. Old files are put in new \'archive\'
subdirectory of the source repository, but not in
distribution archives. These changes are made in order to
lessen the maintenance burden.

* tools/rgb2ycbcr.c
+ Validate values of -v and -h parameters to avoid potential
divide by zero. Fixes CVE-2016-3623, bsc#974618
(http://bugzilla.maptools.org/show_bug.cgi?id=2569)

* tools/tiff2bw.c
+ Fix weight computation that could result of color value
overflow (no security implication). Fix
http://bugzilla.maptools.org/show_bug.cgi?id=2550.

* tools/tiff2pdf.c
+ Avoid undefined behaviour related to overlapping of source and
destination buffer in memcpy() call in
t2p_sample_rgbaa_to_rgb() Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2577
+ Fix out-of-bounds write vulnerabilities in heap allocate buffer
in t2p_process_jpeg_strip(). Reported as MSVR 35098.
+ Fix potential integer overflows on 32 bit builds in
t2p_read_tiff_size() Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2576
+ Fix read -largely- outsize of buffer in
t2p_readwrite_pdf_image_tile(), causing crash, when reading a
JPEG compressed image with TIFFTAG_JPEGTABLES length being one.
Reported as MSVR 35101. CVE-2016-9453, bsc#1011107
+ Fix write buffer overflow of 2 bytes on JPEG compressed images.
Reported as TALOS-CAN-0187, CVE-2016-5652, bsc#1007280. Also
prevents writing 2 extra uninitialized bytes to the file
stream.

* tools/tiff2rgba.c
+ Fix integer overflow in size of allocated buffer, when -b mode
is enabled, that could result in out-of-bounds write. Based
initially on patch tiff-CVE-2016-3945.patch from
libtiff-4.0.3-25.el7_2.src.rpm, with correction for invalid
tests that rejected valid files.
(http://bugzilla.maptools.org/show_bug.cgi?id=2545, bsc#974614)

* tools/tiffcp.c
+ Fix out-of-bounds write on tiled images with odd tile width vs
image width. Reported as MSVR 35103.
+ Fix read of undefined variable in case of missing required
tags. Found on test case of MSVR 35100.

* tools/tiffcrop.c
+ Avoid access outside of stack allocated array on a tiled
separate TIFF with more than 8 samples per pixel.
(CVE-2016-5321, CVE-2016-5323,
http://bugzilla.maptools.org/show_bug.cgi?id=2558,
http://bugzilla.maptools.org/show_bug.cgi?id=2559, bsc#984813,
bsc#984815)
+ Fix memory leak in (recent) error code path. Fixes Coverity
1394415.
+ Fix multiple uint32 overflows in writeBufferToSeparateStrips(),
writeBufferToContigTiles() and writeBufferToSeparateTiles()
that could cause heap buffer overflows. Fixes
http://bugzilla.maptools.org/show_bug.cgi?id=2592
+ Fix out-of-bound read of up to 3 bytes in
readContigTilesIntoBuffer(). Reported as MSVR 35092.
+ Fix out-of-bounds write in loadImage(). From patch
libtiff-CVE-2016-3991.patch from
libtiff-4.0.3-25.el7_2.src.rpm
(http://bugzilla.maptools.org/show_bug.cgi?id=2543, bsc#975070)
+ Fix read of undefined buffer in readContigStripsIntoBuffer()
due to uint16 overflow. Reported as MSVR 35100.
+ Fix various out-of-bounds write vulnerabilities in heap or
stack allocated buffers. Reported as MSVR 35093, MSVR 35096
and MSVR 35097.
+ readContigTilesIntoBuffer: Fix signed/unsigned comparison
warning.

* tools/tiffdump.c
+ Fix a few misaligned 64-bit reads warned by -fsanitize
+ ReadDirectory: Remove uint32 cast to_TIFFmalloc() argument
which resulted in Coverity report. Added more mutiplication
overflow checks

* tools/tiffinfo.c
+ Fix out-of-bound read on some tiled images.
(http://bugzilla.maptools.org/show_bug.cgi?id=2517)
+ TIFFReadContigTileData: Fix signed/unsigned comparison warning.
+ TIFFReadSeparateTileData: Fix signed/unsigned comparison
warning.
- Removed patches:

* tiff-4.0.4-uninitialized_mem_NeXTDecode.patch

* tiff-4.0.6-CVE-2015-8782.patch

* tiff-4.0.6-CVE-2016-3186.patch

* tiff-4.0.6-CVE-2016-3623.patch

* tiff-4.0.6-CVE-2016-3945.patch

* tiff-4.0.6-CVE-2016-3990.patch

* tiff-4.0.6-CVE-2016-3991.patch

* tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch

* tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch

* tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch

* tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch

* tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch
- Fixed in the upsteam release
- Changed patch:

* tiff-4.0.6-CVE-2015-7554.patch -> tiff-4.0.7-CVE-2015-7554.patch
- Rediffed to the changed context

Thu Oct 6 14:00:00 2016 fstrbaAATTsuse.com
- Added patches:

* tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch
- Upstream fixes for MSVR 35093, MSVR 35094, MSVR 35095,
MSVR 35096, MSVR 35097, MSVR 35098.

* tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch
- Enforce bits-per-sample requirements of floating point
predictor. Fixes CVE-2016-3622 [bsc#974449]

Thu Sep 1 14:00:00 2016 fstrbaAATTsuse.com
- Added patches:

* tiff-4.0.6-CVE-2016-3623.patch

* tiff-4.0.6-CVE-2016-3945.patch

* tiff-4.0.6-CVE-2016-3990.patch

* tiff-4.0.6-CVE-2016-3991.patch
- Upstream commits to fix CVE-2016-3623 [bsc#974618],
CVE-2016-3945 [bsc#974614], CVE-2016-3990 [bsc#975069],
CVE-2016-3991 [bsc#975070]

Tue Jul 12 14:00:00 2016 fstrbaAATTsuse.com
- Added patches:

* tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch

* tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch

* tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch
- Upstream commits to fix CVE-2016-5314 [bsc#984831],
CVE-2016-5316 [bsc#984837], CVE-2016-5317 [bsc#984842],
CVE-2016-5320 [bsc#984808] and CVE-2016-5875 [bsc#987351]

Wed Apr 6 14:00:00 2016 fstrbaAATTsuse.com
- Added patch:

* tiff-4.0.6-CVE-2016-3186.patch
- fix CVE-2016-3186: buffer overflow in gif2tiff [bsc#973340]

Mon Feb 1 13:00:00 2016 fstrbaAATTsuse.com
- Added patch:

* tiff-4.0.6-CVE-2015-8782.patch
- fix CVE-2015-8781, CVE-2015-8782, CVE-2015-8783: Out-of-bounds
writes for invalid images (upstream bug #2522) [bsc#964225]

Wed Jan 13 13:00:00 2016 fstrbaAATTsuse.com
- Added patch:

* tiff-4.0.6-CVE-2015-7554.patch
- fix CVE-2015-7554: Out-of-bounds Write in the thumbnail and
tiffcmp tools (upsteam bug #2499) [bsc#960341]

Mon Jan 11 13:00:00 2016 kstreitovaAATTsuse.com
- Added patch:

* tiff-4.0.4-uninitialized_mem_NeXTDecode.patch
- fix uninitialized memory in NeXTDecode (upstream bug #2508)
[bsc#942690]

Tue Dec 8 13:00:00 2015 p.drouandAATTgmail.com
- Update to version 4.0.6

* Supports CMake 2.8.9 and later.

* Add missing file which wasn\'t being distributed, causing unit
tests to fail.

* Make shared/static library building configurable.

* CMake reads all version information directly from configure.ac
to avoid duplication of values.

* CMake builds are now included in \'distcheck\' target.

* Autotools \'make distcheck\' now tests the CMake-based build if
CMake is available.

* Fixes to avoid undefined behaviour of signed types (C standard
compliance).

* Fixes to avoid possible isses when casting to unsigned char.

* Fixes to avoid undefined behaviour with shifts.

* Fix generation of output with 16 bit or 32 bit integer, when
byte swapping is needed, in horizontal predictor (#2521).

* Fix decoding when there is a single pixel to decode
(unlikely case...) and byte swapping is involved.

* Add add explicit masking with 0xff before casting to uchar in
floating-point horizontal differencing and accumulation routines.

* Eliminate requirement for and use of 64-bit constant values.

* tiffgt : Silence glut API deprecation warnings on MacOS X.

* fax2ps : Detect failure to write to temporary file.
- Changes from version 4.0.5

* Support for configure/build using CMake.

* Support for large (> 2GB) files under Microsoft Windows.

* Configuration and building using CMake is now supported under
Microsoft Windows and on Unix-type systems.

* Test for and use fseeko() if it is available. This allows supporting
large files on Unix-type systems with a 32-bit \'long\' type and a
64-bit \'off_t\' type.

* tiffiop.h: Macros added to use 64-bit equivalents for all standard
I/O and POSIX APIs used by libtiff and its tools which are limited
to 2GB in Windows builds. Note that these 64-bit equivalents were
introduced by the CRT provided with Visual Studio 2005 and if the
necessary CRT is not installed on the target computer, the program
will not run. The wrapper macros will not be activated unless the
definition _MSC_VER is at least 1400 or __MSVCRT_VERSION__ is at
least 0x800.

* tif_unix.c: Updated to support large files under Microsoft Windows.
This makes tif_unix.c a completely viable candidate for use under
Windows (in spite of its name) if the CRT is modern enough. Please
note that tif_win32.c already supported large files, but only
\'tiffinfo\' and \'tiffdump\' made any provision to support large files
under Windows.

* _tiffReadProc() and _tiffWriteProc() are modified to chunk I/O to a
maximum size of 2GB for extremely large I/O requests. This surmounts
limitations in the Microsoft Windows read() and write() APIs (which
are limited to the range of a 32-bit \'int\'), and may avoid poor
behavior with extremely large I/O requests on other systems.

* Updated to use I/O wrapper macros from tiffiop.h in order to
support large files under Microsoft Windows.

Tue Aug 4 14:00:00 2015 kstreitovaAATTsuse.com
- use spec-cleaner

Wed Jul 1 14:00:00 2015 pgajdosAATTsuse.com
- update to 4.0.4
D tiff-4.0.3-double-free.patch
D tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch
D tiff-4.0.3-CVE-2013-1961.patch
D erouault.2862.patch
D bfriesen.2805.patch
D tiff-4.0.3-CVE-2013-4232.patch
D tiff-4.0.3-CVE-2013-4244.patch
D erouault.2861.patch
D erouault.2857.patch
D erouault.2856.patch
D erouault.2859.patch
D tiff-4.0.3-CVE-2012-4564.patch
D tiff-4.0.3-tiff2pdf-colors.patch
D erouault.2876.patch
D erouault.2860.patch
D tiff-dither-malloc-check.patch
D tiff-4.0.3-CVE-2013-1960.patch
D erouault.2858.patch
D tiff-handle-TIFFTAG_PREDICTOR.patch
D tiff-4.0.3-CVE-2013-4231.patch
D tiff-4.0.3-CVE-2013-4243.patch
D erouault.2863.patch
D tiff-4.0.3-test-jpeg-turbo.patch

Thu Feb 26 13:00:00 2015 pgajdosAATTsuse.com
- security update: CVE-2014-9655, CVE-2014-8127, CVE-2014-8128,
CVE-2014-8129, CVE-2014-8130, CVE-2015-1547
bnc#914890, bnc#916925, bnc#916927
+ erouault.2856.patch
+ erouault.2857.patch
+ erouault.2858.patch
+ erouault.2859.patch
+ erouault.2860.patch
+ erouault.2861.patch
+ erouault.2862.patch
+ erouault.2863.patch
+ erouault.2876.patch
+ bfriesen.2805.patch
+ tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch
+ tiff-handle-TIFFTAG_PREDICTOR.patch
+ tiff-dither-malloc-check.patch

Mon Dec 22 13:00:00 2014 meissnerAATTsuse.com
- build with PIE

Wed Aug 21 14:00:00 2013 pgajdosAATTsuse.com
- security update

* CVE-2013-4232.patch [bnc#834477]

* CVE-2013-4231.patch [bnc#834477]

* CVE-2013-4244.patch [bnc#834788]

* CVE-2013-4243.patch [bnc#834779]

Wed Jun 26 14:00:00 2013 pgajdosAATTsuse.com
- tiff2pdf: introduced warning when the compression isn\'t lzw or
none [bnc#819142]
- tiff2pdf: fixed crash [bnc#821872]

Tue Apr 30 14:00:00 2013 pgajdosAATTsuse.com
- security update

* CVE-2013-1961.patch [bnc#818117]

* CVE-2013-1960.patch [bnc#817573]

Fri Apr 5 14:00:00 2013 idonmezAATTsuse.com
- Add Source URL, see https://en.opensuse.org/SourceUrls

Mon Nov 5 13:00:00 2012 pgajdosAATTsuse.com
- updated to 4.0.3:

* Add some TIFF/FX support in libtiff.

* Fix bug rewriting image tiles in a compressed file.

* Fix read past end of data buffer.

* etc., see ChangeLog
- removed upstreamed patches:

* bigendian.patch

* dont-fancy-upsampling.patch

* CVE-2012-3401.patch
- new patch:

* test-jpeg-turbo.patch

* CVE-2012-4564.patch [bnc#787892]

Mon Jul 23 14:00:00 2012 pgajdosAATTsuse.com
- fixed CVE-2012-3401 [bnc#770816]

Thu Jun 28 14:00:00 2012 meissnerAATTsuse.com
- RGBA is packed in host order, use the right macros to unpack
and verify in raw_decode test.

Wed Jun 20 14:00:00 2012 pgajdosAATTsuse.com
- updated to 4.0.2: [bnc#767852] [bnc#767854]
tif_getimage.c: added support for _SEPARATED CMYK images.
tif_getimage.c: Added support for greyscale + alpha.
Added TIFFCreateCustomDirectory() and TIFFCreateEXIFDirectory() functions.
tif_print.c: Lots of fixes around printing corrupt or hostile input.
Improve handling of corrupt ycbcrsubsampling values.
tif_unix.c: use strerror to get meaningful error messages.
tif_jpeg.c: fix serious bugs in JPEGDecodeRaw().
tif_jpeg.c: Fix size overflow (zdi-can-1221,CVE-2012-1173).
tiff2pdf: Defend against integer overflows while calculating required
buffer sizes (CVE-2012-2113).

Tue Apr 10 14:00:00 2012 brianAATTaljex.com
- Fix building on older targets from SUSE 10.0 to current.
- Add jbig support

Thu Mar 29 14:00:00 2012 idonmezAATTsuse.com
- Add lzma support
- Implement %check
- Drop visibility patch because it breaks compilation

Wed Mar 28 14:00:00 2012 iAATTmarguerite.su
- change package name libtiff4 to libtiff5.
library number is 5 actually.

Wed Mar 28 14:00:00 2012 iAATTmarguerite.su
- Update to 4.0.1

* configure.ac
- Add libtiff private dependency on -llzma for pkg-config
- Add support for using library symbol versioning on
ELF systems with the GNU linker.

* libtiff/tif_win32.c: Eliminate some minor 64-bit warnings in
tif_win32.c

* libtiff/tif_jpeg.c: Extra caution for case where sp is NULL.

* libtiff/tif_dir.c, libtiff/tif_dirread.c: Extra caution around
assumption tag fetching is always successful.

* libtiff/tiffio.h: Use double-underbar syntax in GCC printf
attribute specification to lessen the risk of accidental macro
substitution.

* Update automake used to 1.11.3.

Wed Mar 28 14:00:00 2012 cfarrellAATTsuse.com
- license update: HPND
tiff license most akin to spdx recognised
http://www.spdx.org/licenses/HPND

Tue Jan 10 13:00:00 2012 crrodriguezAATTopensuse.org
- remove libjpeg-devel and zlib-devel from libtiff-devel
requires as they are _not_ required to use the library.
Now, this _will_ break packages with wrong buildrequires
for good.

Tue Jan 10 13:00:00 2012 crrodriguezAATTopensuse.org
- Hide private symbols using gcc visibility, this has been
applied only to functions that the source code clearly states
that are internal to the library.
- Run spec cleaner

Wed Nov 23 13:00:00 2011 cooloAATTsuse.com
- add libtool as buildrequire to avoid implicit dependency

Fri Aug 5 14:00:00 2011 crrodriguezAATTopensuse.org
- Do not use -fno-strict-aliasing, no longer needed
and will probably slow down the code.
- Fix self-obsoletion warning

Thu Apr 14 14:00:00 2011 pgajdosAATTsuse.cz
- updated to 3.9.5:

* fixed integer overflow CVE-2010-4665

* fixed buffer overflow in ojpeg decoder

* upstreamed:
- oob-read.patch
- CVE-2011-0192.patch
- getimage-64bit.patch
- CVE-2011-1167.patch
- scanlinesize.patch

Thu Mar 31 14:00:00 2011 pgajdosAATTsuse.cz
- fixed regression caused by previous update [bnc#682871]

* modified CVE-2011-0192.patch
- fixed buffer overflow in thunder decoder [bnc#683337]

* added CVE-2011-1167.patch

Thu Feb 17 13:00:00 2011 pgajdosAATTsuse.cz
- fixed buffer overflow [bnc#672510]

* CVE-2011-0192.patch

Mon Sep 6 14:00:00 2010 pgajdosAATTsuse.cz
- fixed \"Possibly exploitable memory corruption issue in libtiff\"
(see http://bugzilla.maptools.org/show_bug.cgi?id=2228)
[bnc#624215]

* scanlinesize.patch
- fixed crash while using libjpeg7 and higher

* dont-fancy-upsampling.patch

Mon Jul 12 14:00:00 2010 pgajdosAATTsuse.cz
- updated to 3.9.4: fixes CVE-2010-2065 -- obsoletes

* integer-overflow.patch

* NULL-deref.patch
- fixes CVE-2010-2067

Wed Jun 23 14:00:00 2010 pgajdosAATTsuse.cz
- fixed CVE-2010-2065

* integer-overflow.patch

* NULL-deref.patch
- fixed out of bounds read

* oob-read.patch
- fixed CVE-2010-2233

* getimage-64bit.patch
- [bnc#612879]

Mon Apr 26 14:00:00 2010 pgajdosAATTsuse.cz
- fixed tiff2pdf output [bnc#599475]

Fri Mar 26 13:00:00 2010 pgajdosAATTsuse.cz
- fixed typo

Tue Mar 16 13:00:00 2010 pgajdosAATTsuse.cz
- updated to 3.9.2: fixed many CVE\'s and obsoletes almost all
our patches (see ChangeLog for details)

Tue Dec 15 13:00:00 2009 jengelhAATTmedozas.de
- add baselibs.conf as a source
- enable parallel building

Thu Aug 6 14:00:00 2009 pgajdosAATTsuse.cz
- fixed integer overflows [bnc#519796]

* CVE-2009-2347.patch

Thu Jul 2 14:00:00 2009 nadvornikAATTsuse.cz
- fixed lzw overflow CVE-2009-2285 [bnc#518698]