CVE-2022-0908: Null Pointer Dereference
libtiff is vulnerable to a denial of service, caused by NULL pointer dereference in tifunix.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
Other sources
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tifdirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-0908?
CVE-2022-0908 is a vulnerability that allows a null source pointer passed as an argument to the memcpy() function in libtiff to cause a Denial of Service via a crafted TIFF file.
How does CVE-2022-0908 impact systems?
CVE-2022-0908 can lead to a Denial of Service on systems running vulnerable versions of libtiff.
Which version of libtiff is affected by CVE-2022-0908?
Versions of libtiff up to 4.3.0 are affected by CVE-2022-0908.
How can I fix CVE-2022-0908?
You can fix CVE-2022-0908 by updating to a version of libtiff that includes the patch for this vulnerability.
Where can I find more information about CVE-2022-0908?
You can find more information about CVE-2022-0908 on the libtiff GitLab page and the Debian security tracker.