CVE-2022-2057: Divide by Zero
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a divide-by-zero error in tiffcrop. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-2057?
CVE-2022-2057 is a vulnerability in the libtiff library that allows attackers to cause a denial-of-service by exploiting a Divide By Zero error in the tiffcrop utility.
How severe is CVE-2022-2057?
CVE-2022-2057 has a severity level of medium, with a CVSS score of 6.5.
Which versions of libtiff are affected by CVE-2022-2057?
Versions 4.4.0 of libtiff are affected by CVE-2022-2057.
How can attackers exploit CVE-2022-2057?
Attackers can exploit CVE-2022-2057 by crafting a malicious TIFF file that triggers the Divide By Zero error in the tiffcrop utility, leading to a denial-of-service condition.
How can I fix CVE-2022-2057?
The fix for CVE-2022-2057 is available with commit f3a5e010 if you compile libtiff from sources.