CVE-2022-0908: Null Pointer Dereference
libtiff is vulnerable to a denial of service, caused by NULL pointer dereference in tifunix.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
Other sources
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tifdirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2~deb10u4Fixed in 4.1.0+git191117-2~deb10u8Fixed in 4.2.0-1+deb11u4Fixed in 4.5.0-6Fixed in 4.5.1+git230720-1
Event History
Frequently Asked Questions
What is CVE-2022-0908?
CVE-2022-0908 is a vulnerability that allows a null source pointer passed as an argument to the memcpy() function in libtiff to cause a Denial of Service via a crafted TIFF file.
How does CVE-2022-0908 impact systems?
CVE-2022-0908 can lead to a Denial of Service on systems running vulnerable versions of libtiff.
Which version of libtiff is affected by CVE-2022-0908?
Versions of libtiff up to 4.3.0 are affected by CVE-2022-0908.
How can I fix CVE-2022-0908?
You can fix CVE-2022-0908 by updating to a version of libtiff that includes the patch for this vulnerability.
Where can I find more information about CVE-2022-0908?
You can find more information about CVE-2022-0908 on the libtiff GitLab page and the Debian security tracker.