Changelog for tiff-debuginfo-4.0.6-10.1.x86_64.rpm :

* Thu Oct 06 2016 fstrbaAATTsuse.com- Added patches:
* tiff-4.0.6-tools-tiffcrop.c-fix-various-out-of-bounds-write-vul.patch - Upstream fixes for MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098.
* tiff-4.0.6-libtiff-tif_getimage.c-TIFFRGBAImageOK-Reject-attemp.patch - Enforce bits-per-sample requirements of floating point predictor. Fixes CVE-2016-3622 [bsc#974449]
* Thu Sep 01 2016 fstrbaAATTsuse.com- Added patches:
* tiff-4.0.6-CVE-2016-3623.patch
* tiff-4.0.6-CVE-2016-3945.patch
* tiff-4.0.6-CVE-2016-3990.patch
* tiff-4.0.6-CVE-2016-3991.patch - Upstream commits to fix CVE-2016-3623 [bsc#974618], CVE-2016-3945 [bsc#974614], CVE-2016-3990 [bsc#975069], CVE-2016-3991 [bsc#975070]
* Tue Jul 12 2016 fstrbaAATTsuse.com- Added patches:
* tiff-4.0.6-libtiff-tif_luv.c-validate-that-for-COMPRESSION_SGIL.patch
* tiff-4.0.6-libtiff-tif_pixarlog.c-fix-potential-buffer-write-ov.patch
* tiff-4.0.6-libtiff-tif_read.c-make-TIFFReadEncodedStrip-and.patch - Upstream commits to fix CVE-2016-5314 [bsc#984831], CVE-2016-5316 [bsc#984837], CVE-2016-5317 [bsc#984842], CVE-2016-5320 [bsc#984808] and CVE-2016-5875 [bsc#987351]
* Wed Apr 06 2016 fstrbaAATTsuse.com- Added patch:
* tiff-4.0.6-CVE-2016-3186.patch - fix CVE-2016-3186: buffer overflow in gif2tiff [bsc#973340]
* Mon Feb 01 2016 fstrbaAATTsuse.com- Added patch:
* tiff-4.0.6-CVE-2015-8782.patch - fix CVE-2015-8781, CVE-2015-8782, CVE-2015-8783: Out-of-bounds writes for invalid images (upstream bug #2522) [bsc#964225]
* Wed Jan 13 2016 fstrbaAATTsuse.com- Added patch:
* tiff-4.0.6-CVE-2015-7554.patch - fix CVE-2015-7554: Out-of-bounds Write in the thumbnail and tiffcmp tools (upsteam bug #2499) [bsc#960341]
* Mon Jan 11 2016 kstreitovaAATTsuse.com- Added patch:
* tiff-4.0.4-uninitialized_mem_NeXTDecode.patch - fix uninitialized memory in NeXTDecode (upstream bug #2508) [bsc#942690]
* Tue Dec 08 2015 p.drouandAATTgmail.com- Update to version 4.0.6
* Supports CMake 2.8.9 and later.
* Add missing file which wasn\'t being distributed, causing unit tests to fail.
* Make shared/static library building configurable.
* CMake reads all version information directly from configure.ac to avoid duplication of values.
* CMake builds are now included in \'distcheck\' target.
* Autotools \'make distcheck\' now tests the CMake-based build if CMake is available.
* Fixes to avoid undefined behaviour of signed types (C standard compliance).
* Fixes to avoid possible isses when casting to unsigned char.
* Fixes to avoid undefined behaviour with shifts.
* Fix generation of output with 16 bit or 32 bit integer, when byte swapping is needed, in horizontal predictor (#2521).
* Fix decoding when there is a single pixel to decode (unlikely case...) and byte swapping is involved.
* Add add explicit masking with 0xff before casting to uchar in floating-point horizontal differencing and accumulation routines.
* Eliminate requirement for and use of 64-bit constant values.
* tiffgt : Silence glut API deprecation warnings on MacOS X.
* fax2ps : Detect failure to write to temporary file.- Changes from version 4.0.5
* Support for configure/build using CMake.
* Support for large (> 2GB) files under Microsoft Windows.
* Configuration and building using CMake is now supported under Microsoft Windows and on Unix-type systems.
* Test for and use fseeko() if it is available. This allows supporting large files on Unix-type systems with a 32-bit \'long\' type and a 64-bit \'off_t\' type.
* tiffiop.h: Macros added to use 64-bit equivalents for all standard I/O and POSIX APIs used by libtiff and its tools which are limited to 2GB in Windows builds. Note that these 64-bit equivalents were introduced by the CRT provided with Visual Studio 2005 and if the necessary CRT is not installed on the target computer, the program will not run. The wrapper macros will not be activated unless the definition _MSC_VER is at least 1400 or __MSVCRT_VERSION__ is at least 0x800.
* tif_unix.c: Updated to support large files under Microsoft Windows. This makes tif_unix.c a completely viable candidate for use under Windows (in spite of its name) if the CRT is modern enough. Please note that tif_win32.c already supported large files, but only \'tiffinfo\' and \'tiffdump\' made any provision to support large files under Windows.
* _tiffReadProc() and _tiffWriteProc() are modified to chunk I/O to a maximum size of 2GB for extremely large I/O requests. This surmounts limitations in the Microsoft Windows read() and write() APIs (which are limited to the range of a 32-bit \'int\'), and may avoid poor behavior with extremely large I/O requests on other systems.
* Updated to use I/O wrapper macros from tiffiop.h in order to support large files under Microsoft Windows.
* Tue Aug 04 2015 kstreitovaAATTsuse.com- use spec-cleaner
* Wed Jul 01 2015 pgajdosAATTsuse.com- update to 4.0.4 D tiff-4.0.3-double-free.patch D tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch D tiff-4.0.3-CVE-2013-1961.patch D erouault.2862.patch D bfriesen.2805.patch D tiff-4.0.3-CVE-2013-4232.patch D tiff-4.0.3-CVE-2013-4244.patch D erouault.2861.patch D erouault.2857.patch D erouault.2856.patch D erouault.2859.patch D tiff-4.0.3-CVE-2012-4564.patch D tiff-4.0.3-tiff2pdf-colors.patch D erouault.2876.patch D erouault.2860.patch D tiff-dither-malloc-check.patch D tiff-4.0.3-CVE-2013-1960.patch D erouault.2858.patch D tiff-handle-TIFFTAG_PREDICTOR.patch D tiff-4.0.3-CVE-2013-4231.patch D tiff-4.0.3-CVE-2013-4243.patch D erouault.2863.patch D tiff-4.0.3-test-jpeg-turbo.patch
* Thu Feb 26 2015 pgajdosAATTsuse.com- security update: CVE-2014-9655, CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130, CVE-2015-1547 bnc#914890, bnc#916925, bnc#916927 + erouault.2856.patch + erouault.2857.patch + erouault.2858.patch + erouault.2859.patch + erouault.2860.patch + erouault.2861.patch + erouault.2862.patch + erouault.2863.patch + erouault.2876.patch + bfriesen.2805.patch + tiff-handle-TIFFTAG_CONSECUTIVEBADFAXLINES.patch + tiff-handle-TIFFTAG_PREDICTOR.patch + tiff-dither-malloc-check.patch
* Mon Dec 22 2014 meissnerAATTsuse.com- build with PIE
* Wed Aug 21 2013 pgajdosAATTsuse.com- security update
* CVE-2013-4232.patch [bnc#834477]
* CVE-2013-4231.patch [bnc#834477]
* CVE-2013-4244.patch [bnc#834788]
* CVE-2013-4243.patch [bnc#834779]
* Wed Jun 26 2013 pgajdosAATTsuse.com- tiff2pdf: introduced warning when the compression isn\'t lzw or none [bnc#819142]- tiff2pdf: fixed crash [bnc#821872]
* Tue Apr 30 2013 pgajdosAATTsuse.com- security update
* CVE-2013-1961.patch [bnc#818117]
* CVE-2013-1960.patch [bnc#817573]
* Fri Apr 05 2013 idonmezAATTsuse.com- Add Source URL, see https://en.opensuse.org/SourceUrls
* Mon Nov 05 2012 pgajdosAATTsuse.com- updated to 4.0.3:
* Add some TIFF/FX support in libtiff.
* Fix bug rewriting image tiles in a compressed file.
* Fix read past end of data buffer.
* etc., see ChangeLog- removed upstreamed patches:
* bigendian.patch
* dont-fancy-upsampling.patch
* CVE-2012-3401.patch- new patch:
* test-jpeg-turbo.patch
* CVE-2012-4564.patch [bnc#787892]
* Mon Jul 23 2012 pgajdosAATTsuse.com- fixed CVE-2012-3401 [bnc#770816]
* Thu Jun 28 2012 meissnerAATTsuse.com- RGBA is packed in host order, use the right macros to unpack and verify in raw_decode test.
* Wed Jun 20 2012 pgajdosAATTsuse.com- updated to 4.0.2: [bnc#767852] [bnc#767854] tif_getimage.c: added support for _SEPARATED CMYK images. tif_getimage.c: Added support for greyscale + alpha. Added TIFFCreateCustomDirectory() and TIFFCreateEXIFDirectory() functions. tif_print.c: Lots of fixes around printing corrupt or hostile input. Improve handling of corrupt ycbcrsubsampling values. tif_unix.c: use strerror to get meaningful error messages. tif_jpeg.c: fix serious bugs in JPEGDecodeRaw(). tif_jpeg.c: Fix size overflow (zdi-can-1221,CVE-2012-1173). tiff2pdf: Defend against integer overflows while calculating required buffer sizes (CVE-2012-2113).
* Tue Apr 10 2012 brianAATTaljex.com- Fix building on older targets from SUSE 10.0 to current.- Add jbig support
* Thu Mar 29 2012 idonmezAATTsuse.com- Add lzma support- Implement %check- Drop visibility patch because it breaks compilation
* Wed Mar 28 2012 iAATTmarguerite.su- change package name libtiff4 to libtiff5. library number is 5 actually.
* Wed Mar 28 2012 iAATTmarguerite.su- Update to 4.0.1
* configure.ac - Add libtiff private dependency on -llzma for pkg-config - Add support for using library symbol versioning on ELF systems with the GNU linker.
* libtiff/tif_win32.c: Eliminate some minor 64-bit warnings in tif_win32.c
* libtiff/tif_jpeg.c: Extra caution for case where sp is NULL.
* libtiff/tif_dir.c, libtiff/tif_dirread.c: Extra caution around assumption tag fetching is always successful.
* libtiff/tiffio.h: Use double-underbar syntax in GCC printf attribute specification to lessen the risk of accidental macro substitution.
* Update automake used to 1.11.3.
* Wed Mar 28 2012 cfarrellAATTsuse.com- license update: HPND tiff license most akin to spdx recognised http://www.spdx.org/licenses/HPND
* Tue Jan 10 2012 crrodriguezAATTopensuse.org- remove libjpeg-devel and zlib-devel from libtiff-devel requires as they are _not_ required to use the library. Now, this _will_ break packages with wrong buildrequires for good.
* Tue Jan 10 2012 crrodriguezAATTopensuse.org- Hide private symbols using gcc visibility, this has been applied only to functions that the source code clearly states that are internal to the library.- Run spec cleaner
* Wed Nov 23 2011 cooloAATTsuse.com- add libtool as buildrequire to avoid implicit dependency
* Fri Aug 05 2011 crrodriguezAATTopensuse.org- Do not use -fno-strict-aliasing, no longer needed and will probably slow down the code.- Fix self-obsoletion warning
* Thu Apr 14 2011 pgajdosAATTsuse.cz- updated to 3.9.5:
* fixed integer overflow CVE-2010-4665
* fixed buffer overflow in ojpeg decoder
* upstreamed: - oob-read.patch - CVE-2011-0192.patch - getimage-64bit.patch - CVE-2011-1167.patch - scanlinesize.patch
* Thu Mar 31 2011 pgajdosAATTsuse.cz- fixed regression caused by previous update [bnc#682871]
* modified CVE-2011-0192.patch- fixed buffer overflow in thunder decoder [bnc#683337]
* added CVE-2011-1167.patch
* Thu Feb 17 2011 pgajdosAATTsuse.cz- fixed buffer overflow [bnc#672510]
* CVE-2011-0192.patch
* Mon Sep 06 2010 pgajdosAATTsuse.cz- fixed \"Possibly exploitable memory corruption issue in libtiff\" (see http://bugzilla.maptools.org/show_bug.cgi?id=2228) [bnc#624215]
* scanlinesize.patch- fixed crash while using libjpeg7 and higher
* dont-fancy-upsampling.patch
* Mon Jul 12 2010 pgajdosAATTsuse.cz- updated to 3.9.4: fixes CVE-2010-2065 -- obsoletes
* integer-overflow.patch
* NULL-deref.patch- fixes CVE-2010-2067
* Wed Jun 23 2010 pgajdosAATTsuse.cz- fixed CVE-2010-2065
* integer-overflow.patch
* NULL-deref.patch- fixed out of bounds read
* oob-read.patch- fixed CVE-2010-2233
* getimage-64bit.patch- [bnc#612879]
* Mon Apr 26 2010 pgajdosAATTsuse.cz- fixed tiff2pdf output [bnc#599475]
* Fri Mar 26 2010 pgajdosAATTsuse.cz- fixed typo
* Tue Mar 16 2010 pgajdosAATTsuse.cz- updated to 3.9.2: fixed many CVE\'s and obsoletes almost all our patches (see ChangeLog for details)
* Tue Dec 15 2009 jengelhAATTmedozas.de- add baselibs.conf as a source- enable parallel building
* Thu Aug 06 2009 pgajdosAATTsuse.cz- fixed integer overflows [bnc#519796]
* CVE-2009-2347.patch
* Thu Jul 02 2009 nadvornikAATTsuse.cz- fixed lzw overflow CVE-2009-2285 [bnc#518698]
* Wed Feb 04 2009 nadvornikAATTsuse.cz- fixed an endless loop on invalid images (bnc#444079) CVE-2008-1586
* Tue Jan 13 2009 olhAATTsuse.de- obsolete old libtiff-64bit on ppc64 (bnc#437293)
* Wed Jan 07 2009 olhAATTsuse.de- obsolete old -XXbit packages (bnc#437293)
* Sun Sep 07 2008 schwabAATTsuse.de- Fix conflicting options.
* Tue Aug 19 2008 nadvornikAATTsuse.cz- fixed buffer overflows in LZW code (CVE-2008-2327) [bnc#414946]
* Sun May 18 2008 cooloAATTsuse.de- fix rename of xxbit packages
* Thu Apr 10 2008 roAATTsuse.de- added baselibs.conf file to build xxbit packages for multilib support
* Fri Jul 27 2007 roAATTsuse.de- add provides and obsoletes for libtiff to libtiff3 package
* Thu Jul 19 2007 nadvornikAATTsuse.cz- renamed libtiff to libtiff3- do not package static libraries- added zlib-devel to BuildRequires
* Mon Jun 12 2006 nadvornikAATTsuse.cz- fixed a typo in the previous change [#179051]
* Fri Jun 02 2006 nadvornikAATTsuse.cz- fixed buffer overflow in tiffsplit (CVE-2006-2656) [#179051]- fixed buffer overflow in tiff2pdf [#179587]
* Wed Apr 12 2006 nadvornikAATTsuse.cz- updated to 3.8.2 [#165237]
* bugfix release
* fixed several segfaults caused by incorrect tiff data
* Tue Feb 07 2006 nadvornikAATTsuse.cz- fixed crash on certain tiff images CVE-2006-0405 [#145757]
* Wed Jan 25 2006 mlsAATTsuse.de- converted neededforbuild to BuildRequires
* Thu Jan 12 2006 nadvornikAATTsuse.cz- compile with -fstack-protector
* Tue Jan 03 2006 nadvornikAATTsuse.cz- updated to 3.8.0:
* Read-only support for custom directories (e.g. EXIF directory)
* Preliminary support for MS MDI format
* Mon Oct 10 2005 nadvornikAATTsuse.cz- built with -fno-strict-aliasing
* Fri Jul 15 2005 nadvornikAATTsuse.cz- updated to 3.7.3
* Tue May 24 2005 nadvornikAATTsuse.cz- updated to 3.7.2- fixed 64bit bug in ppm2tiff [#85440]- fixed buffer overflow in BitsPerSample [#82787]
* Thu Feb 17 2005 nadvornikAATTsuse.cz- fixed reading of alpha channel
* Sun Jan 16 2005 roAATTsuse.de- added c++ to neededforbuild
* Fri Jan 07 2005 nadvornikAATTsuse.cz- use typedef int int32 on all architectures
* Wed Jan 05 2005 nadvornikAATTsuse.cz- disabled c++ API as it would add a dependency on c++ libraries
* Mon Jan 03 2005 nadvornikAATTsuse.cz- updated to 3.7.1: bugfix release
* Wed Dec 15 2004 nadvornikAATTsuse.cz- added README.SUSE pointing to the documentation [#48601]- moved man3 to devel subpackage
* Fri Oct 22 2004 nadvornikAATTsuse.cz- updated to 3.7.0 - security fixes are included in mainstream
* Wed Oct 20 2004 meissnerAATTsuse.de- Initialize ycbcrsubsampling to be not 0 in case of bad tiffs to avoid denial of service by divison/0.
* Tue Oct 12 2004 nadvornikAATTsuse.cz- do not call TIFFTileSize with uninitialized values [#44635]
* Thu Oct 07 2004 pmladekAATTsuse.cz- fixed much more buffer overflows (the older tiff-alt-bound-CheckMalloc.patch is included in the new libtiff-3.6.1-alt-bound.patch now) [#44635]
* Thu Sep 30 2004 nadvornikAATTsuse.cz- fixed more buffer overflows [#44635]
* Tue Sep 21 2004 nadvornikAATTsuse.cz- fixed multiple buffer overflows - CAN-2004-0803 [#44635]- disabled old jpeg support because of security problems [#45116]
* Tue Aug 31 2004 nadvornikAATTsuse.cz- added LZW support
* Wed Aug 25 2004 kukukAATTsuse.de- Create -devel subpackage- Add libjpeg-devel to neededforbuild- Avoid /bin/sh in PreRequires
* Fri Jul 02 2004 maxAATTsuse.de- port.h is needed as well.
* Thu May 06 2004 maxAATTsuse.de- Install private headers (tif_dir.h, tiffiop.h).
* Tue Apr 27 2004 nadvornikAATTsuse.cz- fixed tif_fax3 from cvs [#39515]
* Mon Feb 09 2004 nadvornikAATTsuse.cz- updated to 3.6.1- fixed dangerous compiler warnings
* Sat Jan 10 2004 adrianAATTsuse.de- add %defattr and %run_ldconfig
* Tue May 20 2003 roAATTsuse.de- remove cvs subdirs
* Sat Jul 27 2002 kukukAATTsuse.de- Provide libtiff-devel in libtiff [Bug #17260]
* Fri Jul 26 2002 adrianAATTsuse.de- fix neededforbuild
* Wed Jul 03 2002 nadvornikAATTsuse.cz- fixed segfault in fax2tiff [bug #16818]- fixed size of int32 on 64bit architectures
* Tue Jun 25 2002 roAATTsuse.de- fixed directory permissions
* Wed Jun 19 2002 nadvornikAATTsuse.cz- compiled with OJPEG_SUPPORT [bug #16408]
* Thu Apr 18 2002 kukukAATTsuse.de- Fix to compile on lib64 architectures
* Wed Feb 06 2002 cooloAATTsuse.de- use %_libdir
* Thu Jan 24 2002 okirAATTsuse.de- Fixed a tempfile race in fax2ps
* Tue Dec 11 2001 nadvornikAATTsuse.cz- updated to 3.5.7: bugfix release
* Wed May 09 2001 mfabianAATTsuse.de- bzip2 sources
* Thu Mar 15 2001 schwabAATTsuse.de- Fix for ia64.
* Fri May 26 2000 bubnikvAATTsuse.cz- sorted
* Thu May 25 2000 schwabAATTsuse.de- Fix dso configure check for ia64.
* Thu May 11 2000 nadvornikAATTsuse.cz- update to 3.5.5- added BuildRoot
* Tue Jan 25 2000 roAATTsuse.de- manpages to /usr/share using macro
* Mon Jan 03 2000 schwabAATTsuse.de- Update to 3.5.4 (Y2K fix)
* Mon Sep 13 1999 bsAATTsuse.de- ran old prepare_spec on spec file to switch to new prepare_spec.
* Wed Jan 13 1999 roAATTsuse.de- respect systems where libc is libc.so.6.1 (alpha)
* Wed Nov 25 1998 roAATTsuse.de- update to 3.4 (final) named 3.4.final for rpm- moved from /usr/X11R6 to /usr
* Wed Jul 29 1998 wernerAATTsuse.de- Link shared libs explicit with -lc
* Tue May 12 1998 roAATTsuse.de- extracted package from libgr / build from own sources