CVE-2022-0561: Null Pointer Dereference
LibTIFF is vulnerable to a denial of service, caused by a NULL pointer dereference in memcpy() function in TIFFFetchStripThing() in tifdirread.c. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
Other sources
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-0561?
CVE-2022-0561 is a vulnerability in the libtiff library that allows a null source pointer to be passed as an argument to the memcpy() function, leading to a denial of service (DoS) attack via a crafted TIFF file.
Who is affected by CVE-2022-0561?
Users of libtiff versions from 3.9.0 to 4.3.0 are affected by CVE-2022-0561.
What is the severity of CVE-2022-0561?
CVE-2022-0561 has a severity rating of 5.5 (medium).
How can I fix CVE-2022-0561?
For users that compile libtiff from sources, the fix for CVE-2022-0561 is available with commit eecb0712.
Where can I find more information about CVE-2022-0561?
You can find more information about CVE-2022-0561 on the official GitLab page: [link].