CVE-2009-5022: Buffer Overflow
Heap-based buffer overflow in tifojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.
Other sources
The libtiff OJPEG decoder contains a heap buffer overflow when decoding certain malformed data.
This was made known via the upstream 3.9.5 announcement. The bug is quite old.
upstream bug: http://bugzilla.maptools.org/showbug.cgi?id=1999
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5022?
CVE-2009-5022 has a high severity rating due to the risk of remote code execution through crafted TIFF files.
How do I fix CVE-2009-5022?
To fix CVE-2009-5022, update LibTIFF to version 3.9.5 or later.
Which versions of LibTIFF are affected by CVE-2009-5022?
All LibTIFF versions prior to 3.9.5, including versions 3.4 through 3.9.4, are affected by CVE-2009-5022.
What types of attacks can exploit CVE-2009-5022?
CVE-2009-5022 can be exploited via crafted TIFF files, allowing attackers to execute arbitrary code on the victim's system.
Is there a workaround for CVE-2009-5022 before updating?
Disabling the use of the OJPEG decoder in applications that utilize LibTIFF may serve as a temporary workaround for CVE-2009-5022.