CVE-2022-1623: Medium severity tiff vulnerability

Published May 11, 2022

Updated

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tiflzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.

Affected Software

6 affected componentsFixes available

debian/tiff

4.1.0+git191117-2~deb10u44.1.0+git191117-2~deb10u84.2.0-1+deb11u44.2.0-1+deb11u54.5.0-6+deb12u14.5.1+git230720-3

LibTIFF libtiff=4.3.0

Fedoraproject Fedora=35

Fedoraproject Fedora=36

NetApp ONTAP Select Deploy administration utility

Debian Debian Linux=11.0

Remediation

Patch Available

https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a

Event History

May 11, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-1623.

What is the title of this vulnerability?

The title of this vulnerability is 'LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624 allowing attackers to cause a denial-of-service via a crafted tiff file.'

What is the description of this vulnerability?

This vulnerability in LibTIFF allows attackers to cause a denial-of-service by exploiting an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624 using a crafted tiff file.

How can attackers exploit this vulnerability?

Attackers can exploit this vulnerability by using a crafted tiff file to trigger an out-of-bounds read in LZWDecode.

How can I fix this vulnerability?

Users that compile libtiff from sources can fix this vulnerability by applying the fix available with commit b4e79bfa.