CVE-2022-1623: Medium severity LibTIFF libtiff vulnerability
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tiflzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.5.0-6+deb12u4Fixed in 4.7.0-3+deb13u3Fixed in 4.7.2-1 - Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.4.0~rc1-1 - Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch b4e79bfa
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-1623.
What is the title of this vulnerability?
The title of this vulnerability is 'LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624 allowing attackers to cause a denial-of-service via a crafted tiff file.'
What is the description of this vulnerability?
This vulnerability in LibTIFF allows attackers to cause a denial-of-service by exploiting an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624 using a crafted tiff file.
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability by using a crafted tiff file to trigger an out-of-bounds read in LZWDecode.
How can I fix this vulnerability?
Users that compile libtiff from sources can fix this vulnerability by applying the fix available with commit b4e79bfa.