• https://download.osgeo.org/libtiff/ (Download)

• (2020-01-13) Updated to version: tiff-4.1.0
• (2017-11-24) Updated to version: tiff-4.0.9
• (2017-05-27) Updated to version: tiff-4.0.8
• (2016-11-30) Updated to version: tiff-4.0.7
• (2015-11-05) Updated to version: tiff-4.0.6
• (2015-03-30) Updated to version: tiff-4.0.4beta
• (2012-09-25) Updated to version: tiff-4.0.3
• (2012-06-27) Updated to version: tiff-4.0.2
• (2012-04-23) Updated to version: tiff-4.0.1
• (2011-05-12) Updated to version: tiff-3.9.5

Log message:
Update to 4.1.0.
Also enable xz and zstd compression as proposed by landry@ eight months
ago.
Include an upstream fix for a new sanity check that broke OJPEG compression;
proposed by sthen@.
ok sthen@

Log message:
replace simple PERMIT_PACKAGE_CDROM=Yes with PERMIT_PACKAGE=Yes

Log message:
switch some master_sites and homepage lines to https. ok sthen

Log message:
Update to 4.0.10.
Disable the new support for ZSTD and WebP compression for the time being
to avoid bringing in extra dependencies.

Log message:
Add COMPILER lines to c++ ports which currently use the default. Adjust
some existing COMPILER lines with arch restrictions etc. In the usual
case this is now using "COMPILER = base-clang ports-gcc base-gcc" on
ports with c++ libraries in WANTLIB.
This is basically intended to be a noop on architectures using clang
as the system compiler, but help with other architectures where we
currently have many ports knocked out due to building with an unsuitable
compiler -
- some ports require c++11/newer so the GCC version in base that is used
on these archirtectures is too old.
- some ports have conflicts where an executable is built with one compiler
(e.g. gcc from base) but a library dependency is built with a different
one (e.g. gcc from ports), resulted in mixing incompatible libraries in the
same address space.
devel/gmp is intentionally skipped as it's on the path to building gcc -
the c++ library there is unused in ports (and not built by default upstream)
so intending to disable building gmpcxx in a future commit.

Log message:
bump LIBCXX/LIBECXX/COMPILER_LIBCXX ports.

Log message:
add pthread to COMPILER_LIBCXX.
white lie, but it allows clang and gcc to be more similar
bump accordingly.

Log message:
use COMPILER_LIBCXX where applicable

Log message:
Security update to 4.0.8:
Fixes CVE-2017-5225, CVE-2017-7592 to -7602

Log message:
Security update to 4.0.8:
Fixes CVE-2017-5225, CVE-2017-7592 to -7602

Log message:
use LIBCXX

Log message:
bump REVISION to clearly distinguish this from the -stable package,
which has a different shared library major version; ok jca@ kili@

Log message:
Update to 4.0.7.
* Multiple security fixes, including
CVE-2016-3622, CVE-2014-8127, CVE-2016-9273, CVE-2016-9448,
MSVR 35094, MSVR 35095, MSVR 35105
* Remove obsolete tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, ycbcr
Minor patches to maintain ABI compatibility with 4.0.6.

Log message:
Update to 4.0.7.
* Multiple security fixes, including
CVE-2016-3622, CVE-2014-8127, CVE-2016-9273, CVE-2016-9448,
MSVR 35094, MSVR 35095, MSVR 35105
* Remove obsolete tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, ycbcr
Minor patches to maintain ABI compatibility with 4.0.6.

Log message:
Update to 4.0.7.
* Multiple security fixes, including
CVE-2016-3622, CVE-2014-8127, CVE-2016-9273, CVE-2016-9448,
MSVR 35094, MSVR 35095, MSVR 35105
* Remove obsolete tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, ycbcr

Log message:
fixes for CVE-2016-3186 and CVE-2016-5875

Log message:
fixes for CVE-2016-3186 and CVE-2016-5875

Log message:
garbage collect CONFIGURE_SHARED

Log message:
Fix a number of out-of-bound reads and writes, including CVE-2015-8665 and
CVE-2015-8683.  From upstream CVS.

Log message:
Fix a number of out-of-bound reads and writes, including CVE-2015-8665 and
CVE-2015-8683.  From upstream CVS.

Log message:
update to 4.0.6, no major changes

Log message:
Update to 4.0.4.  No major changes.

Log message:
Security update to 4.0.4beta (plus one further upstream fix).
Should fix CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130,
CVE-2014-9655, CVE-2015-1547.

Log message:
Security update to 4.0.4beta (plus one further upstream fix).
Should fix CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130,
CVE-2014-9655, CVE-2015-1547.

Log message:
Security update to 4.0.4beta (plus one further upstream fix).
Should fix CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130,
CVE-2014-9655, CVE-2015-1547.

Log message:
Update to 3.9.5, help and ok naddy@

Log message:
Security fix for CVE-2011-1167, libtiff heap-based buffer overflow

Log message:
Security fix for CVE-2011-1167, libtiff heap-based buffer overflow

Log message:
Security fix for CVE-2011-0192: buffer overflow in Fax4Decode.

Log message:
Security fix for CVE-2011-0192: buffer overflow in Fax4Decode.

Log message:
new depends

Log message:
WANTLIB conversion

Log message:
USE_GROFF=Yes

Log message:
SECURITY FIX
Resolves CVE-2010-1411
merged from upstream via redhat
reads ok to stephan@, ok naddy@

Log message:
Fix MASTER_SITES.
from patrick keshishian

Log message:
SECURITY:
Update to 3.9.4, which includes fixes for CVE-2009-2347 and CVE-2010-1411.

Log message:
MFC:
SECURITY FIX
Resolves CVE-2009-2347:
Fix several places in tiff2rgba and rgb2ycbcr that were being careless about
possible integer overflow in calculation of buffer sizes.

Log message:
MFC:
SECURITY FIX
Resolves:
SA35515:
LibTIFF "LZWDecodeCompat()" Buffer Underflow Vulnerability
CVE-2009-2347:
Fix several places in tiff2rgba and rgb2ycbcr that were being careless about
possible integer overflow in calculation of buffer sizes.

Log message:
- SECURITY FIX for CVE-2009-2347 (integer overflows in tiff tools)
patch taken from upstream bugreport:
http://bugzilla.maptools.org/show_bug.cgi?id=2079
ok ajacoutot@

Log message:
SECURITY FIX for for SA35515,
LibTIFF "LZWDecodeCompat()" Buffer Underflow Vulnerability
Patch from upstream bugreport #2065 (committed to CVS).

Log message:
fix a silly C99-ism to allow building with gcc2

Log message:
SECURITY fixes for CVE-2006-2656 and CVE-2006-3459 through 3465.
Man page fixes.
Mostly via FreeBSD.  Approving noises from bernd@ and jasper@

Log message:
Security fix for SA31610
http://secunia.com/advisories/31610
LibTIFF LZW Decoder Buffer Underflow Vulnerability
Patch extracted from Debian's tiff_3.8.2-7+etch1
"looks fine" ajacoutot@

Log message:
remove surrounding quotes from COMMENT/BROKEN/PERMIT_*

Log message:
base64 checksums.

Log message:
new lib specs

Log message:
MFC:
SECURITY:
Prevent sign extension on integer promotion that leads to a buffer overflow.
Minimal fix from upstream CVS.  CVE-2006-2193.

Log message:
MFC:
SECURITY:
Prevent sign extension on integer promotion that leads to a buffer overflow.
Minimal fix from upstream CVS.  CVE-2006-2193.

Log message:
SECURITY:
Prevent sign extension on integer promotion that leads to a buffer overflow.
Minimal fix from upstream CVS.  CVE-2006-2193.
prodded by bernd@

Log message:
update to 3.8.2: bugfix release

Log message:
fix broken manpages, found out because makewhatis was complaining...

Log message:
update to 3.8.1

Log message:
more C++ libs bumps. Done thru mail, plus lizards.

Log message:
remove MODGNU_SHARED_LIBS

Log message:
SHARED_LIBS
ok espie@

Log message:
ups, forgot to commit this PKGNAME bump:
updated packages for these ports where not build in a sane environment
bump PKGNAME for fixed packages

Log message:
updated packages for these ports where not build in a sane environment
bump PKGNAME for fixed packages

Log message:
Fix a Denial of Service vulnerability and a buffer overflow.
- Check for zero YCbCr subsampling values which cause a division by zero crash.
- Properly check the BitsPerSample tag.
CAN-2005-1544

Log message:
Fix a Denial of Service vulnerability and a buffer overflow.
- Check for zero YCbCr subsampling values which cause a division by zero crash.
- Properly check the BitsPerSample tag.
CAN-2005-1544

Log message:
Update to 3.7.3; from Bernd Ahlers <b.ahlers@ba-net.org>.
Major changes:
* Replace runtime endianess check with the compile time one.
* Added support for the new predictor type (floating point predictor),
defined at the TIFF Technical Note 3.
* Added Support for custom tags, passed by value. Added support for
all DNG tags.

Log message:
new master site mirror, from FreeBSD

Log message:
update to 3.7.2 which integrates the numerous security patches
brad@ drops maintainership

Log message:
SECURITY:
fix multiple vulnerabilities; bump PKGNAME
http://www.vuxml.org/openbsd/d045aeb6-9ea6-11d9-9623-00065bd5b0b6.html
ok brad@

Log message:
this stuff builds without really installing it now.

Log message:
cumulative update with patches of recent months
MFC:
fix an issue with not being able to open some valid TIFF files.
http://www.sigmasoft.com/~openbsd/archive/openbsd-ports/200503/msg00090.html
From: Bernd Ahlers <b dot ahlers at ba-net dot org>
---
Integer overflow in tif_dirread.c and tif_fax3.c for libtiff allows remote
attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII
or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a
heap-based buffer overflow.
CAN-2004-1308
---
fix an issue with alpha channels.
http://bugzilla.remotesensing.org/show_bug.cgi?id=718
---
fix MASTER_SITES; From: Bernd Ahlers <b dot ahlers at ba-net dot org>
---
Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
ok brad@

Log message:
cumulative update with patches of recent months
MFC:
fix an issue with not being able to open some valid TIFF files.
http://www.sigmasoft.com/~openbsd/archive/openbsd-ports/200503/msg00090.html
From: Bernd Ahlers <b dot ahlers at ba-net dot org>
---
Integer overflow in tif_dirread.c and tif_fax3.c for libtiff allows remote
attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII
or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a
heap-based buffer overflow.
CAN-2004-1308
---
fix an issue with alpha channels.
http://bugzilla.remotesensing.org/show_bug.cgi?id=718
---
fix MASTER_SITES; From: Bernd Ahlers <b dot ahlers at ba-net dot org>
---
Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
ok brad@

Log message:
missed part of the alpha channels fix.

Log message:
fix an issue with not being able to open some valid TIFF files.
http://www.sigmasoft.com/~openbsd/archive/openbsd-ports/200503/msg00090.html
From: Bernd Ahlers <b dot ahlers at ba-net dot org>

Log message:
- bump PKGNAME
- fix MASTER_SITES; From: Bernd Ahlers <b dot ahlers at ba-net dot org>

Log message:
Integer overflow in tif_dirread.c and tif_fax3.c for libtiff allows remote
attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII
or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a
heap-based buffer overflow.
CAN-2004-1308

Log message:
Integer overflow in the tiffdump utility for libtiff allows remote
attackers to cause a denial of service (application crash) and
possibly execute arbitrary code via a crafted TIFF file.
CAN-2004-1183

Log message:
fix an issue with alpha channels.
http://bugzilla.remotesensing.org/show_bug.cgi?id=718

Log message:
SIZE

Log message:
fix a few WANTLIB issues.
Install librpmbuild since lib/rpmgettext wants it.

Log message:
Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886

Log message:
new plists

Log message:
new plists

Log message:
Add a patch to fix libtiff 3.6.1 with HylaFAX.
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=500
http://bugzilla.remotesensing.org/show_bug.cgi?id=483
Thanks to Uwe Dippel <udippel at uniten dot edu dot my> for
bringing this to my attention.

Log message:
Add a patch to fix libtiff 3.6.1 with HylaFAX.
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=500
http://bugzilla.remotesensing.org/show_bug.cgi?id=483
Thanks to Uwe Dippel <udippel at uniten dot edu dot my> for
bringing this to my attention.

Log message:
upgrade to libtiff 3.6.1

Log message:
remove workarounds for gcc2.95/sparc64 optimizer bugs

Log message:
argh, damn cvs. this should have been updated and not removed.

Log message:
upgrade to libtiff 3.6.0

Log message:
remove WWW lines

Log message:
incomplete format string; submitted upstream, brad@ ok

Log message:
No regression tests available.