ELSA-2026-41892

ELSA-2026-41892 - libtiff security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-20

Description

[4.6.0-8.4]
- fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374)
- make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281)

[4.6.0-8.3]
- reintroduce ignore option -i as it is required for tests (RHEL-185328)

[4.6.0-8.2]
- backport documentation change for CVE-2023-52355 (RHEL-178281)

Related CVEs

CVE-2023-52355

CVE-2026-12912

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	libtiff-4.6.0-8.el10_2.4.src.rpm	c38ee8c90930ef68aa22b43fcda072c4959a0c94cf42de6f891a5a17dcc3670d	-	ol10_aarch64_appstream
	libtiff-4.6.0-8.el10_2.4.src.rpm	c38ee8c90930ef68aa22b43fcda072c4959a0c94cf42de6f891a5a17dcc3670d	-	ol10_aarch64_codeready_builder
	libtiff-4.6.0-8.el10_2.4.aarch64.rpm	b7b466315a9999fc03a8faaa68b651c32c00097cafa15f596c8d84d8bc47f3f2	-	ol10_aarch64_appstream
	libtiff-devel-4.6.0-8.el10_2.4.aarch64.rpm	da0e669e04396ed9f732068c7a9d28492f0bce0b7c2ddb0464716e5e58fbc9be	-	ol10_aarch64_appstream
	libtiff-tools-4.6.0-8.el10_2.4.aarch64.rpm	ade88bdf3160823171266ece341fa1c56b3e962d3f2826953ecfa37d43eec570	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	libtiff-4.6.0-8.el10_2.4.src.rpm	c38ee8c90930ef68aa22b43fcda072c4959a0c94cf42de6f891a5a17dcc3670d	-	ol10_x86_64_appstream
	libtiff-4.6.0-8.el10_2.4.src.rpm	c38ee8c90930ef68aa22b43fcda072c4959a0c94cf42de6f891a5a17dcc3670d	-	ol10_x86_64_codeready_builder
	libtiff-4.6.0-8.el10_2.4.x86_64.rpm	6c4e39f20c84e0a62ed7c9411078e2452dbfd3a5e5798238b3862abf605571aa	-	ol10_x86_64_appstream
	libtiff-devel-4.6.0-8.el10_2.4.x86_64.rpm	d87715a2adb64a640be2f05c8eb4136a2aa2cfef4f884180cb497df62d952208	-	ol10_x86_64_appstream
	libtiff-tools-4.6.0-8.el10_2.4.x86_64.rpm	d348405830075ffed15c8623ba954244021b5aa9e1c05d7ab959179bd9a1d74b	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team