ALAS2027-2026-014

References: CVE-2026-36849  CVE-2026-12912  CVE-2026-52490  CVE-2026-52492 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-52492:
An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized heap allocation and subsequent heap-based buffer overflow during YCbCr conversion of a crafted TIFF image

CVE-2026-52490:
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c

CVE-2026-36849:
Denial of Service via large SamplesPerPixel tag

CVE-2026-12912:
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).

Issue Correction:
Run dnf update libtiff or dnf update --advisory ALAS2027-2026-014 to update your system.

New Packages:

aarch64:
    libtiff-debuginfo-4.7.2-1.amzn2027.aarch64
    libtiff-static-4.7.2-1.amzn2027.aarch64
    libtiff-tools-4.7.2-1.amzn2027.aarch64
    libtiff-tools-debuginfo-4.7.2-1.amzn2027.aarch64
    libtiff-4.7.2-1.amzn2027.aarch64
    libtiff-debugsource-4.7.2-1.amzn2027.aarch64
    libtiff-devel-4.7.2-1.amzn2027.aarch64

src:
    libtiff-4.7.2-1.amzn2027.src

x86_64:
    libtiff-4.7.2-1.amzn2027.x86_64
    libtiff-static-4.7.2-1.amzn2027.x86_64
    libtiff-debuginfo-4.7.2-1.amzn2027.x86_64
    libtiff-devel-4.7.2-1.amzn2027.x86_64
    libtiff-debugsource-4.7.2-1.amzn2027.x86_64
    libtiff-tools-debuginfo-4.7.2-1.amzn2027.x86_64
    libtiff-tools-4.7.2-1.amzn2027.x86_64