CVE-2022-1355: Buffer Overflow
A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service.
Other sources
A stack-buffer-overflow flaw was found in tiffcp.c in main()
References: https://gitlab.com/libtiff/libtiff/-/issues/400 https://gitlab.com/libtiff/libtiff/-/mergerequests/323
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-1355?
CVE-2022-1355 is a stack buffer overflow vulnerability found in Libtiff's tiffcp.c in the main() function.
How does CVE-2022-1355 affect the software?
CVE-2022-1355 affects the tiffcp tool in Libtiff, allowing an attacker to trigger a stack buffer overflow issue and potentially cause a denial of service.
What versions of the software are affected by CVE-2022-1355?
Versions 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, and 4.5.1+git230720-1 of the tiff package in Debian are affected by CVE-2022-1355.
How can CVE-2022-1355 be fixed?
To fix CVE-2022-1355, update the tiff package to version 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, or 4.5.1+git230720-1.
What is the Common Weakness Enumeration (CWE) for CVE-2022-1355?
The Common Weakness Enumeration (CWE) for CVE-2022-1355 is CWE-119.