CVE-2022-0907: Null Pointer Dereference
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1 - Upgrade
Upgrade
alpine/tiffto a version that resolves this vulnerability.Fixed in 4.3.0-r0 - Upgrade
Upgrade
alpine/tiffto a version that resolves this vulnerability.Fixed in 4.3.0-r1 - Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.3.0-6 - Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch f2b656e2
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-0907.
What is the severity rating of CVE-2022-0907?
The severity rating of CVE-2022-0907 is 5.5 (medium).
How does the vulnerability CVE-2022-0907 occur?
The vulnerability CVE-2022-0907 occurs due to an unchecked return value to NULL pointer dereference in tiffcrop in libtiff 4.3.0.
What is the impact of CVE-2022-0907?
The impact of CVE-2022-0907 is a denial-of-service (DoS) attack caused by a crafted tiff file.
How can I fix CVE-2022-0907?
For users that compile libtiff from sources, the fix is available with commit f2b656e2.