CVE-2022-2867: Integer Underflow
In libtiff's tiffcrop utility, a uint32t underflow results in an out-of-bounds read and write in extractContigSamples8bits and extractContigSamplesShifted32bits of tiffcrop.c.
References: https://gitlab.com/libtiff/libtiff/-/issues/350 https://gitlab.com/libtiff/libtiff/-/issues/351 https://gitlab.com/libtiff/libtiff/-/mergerequests/294/diffs?commitid=7d7bfa4416366ec64068ac389414241ed4730a54
Other sources
LibTIFF is vulnerable to a denial of service, caused by a uint32t underflow that leads to an out-of-bounds read and write in the extractContigSamples8bits and extractContigSamplesShifted32bits routines when parsing files in tiffcrop.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
libtiff's tiffcrop utility has a uint32t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2~deb10u8Fixed in 4.2.0-1+deb11u4Fixed in 4.2.0-1+deb11u5Fixed in 4.5.0-6+deb12u1Fixed in 4.5.1+git230720-3 - Upgrade
Upgrade
redhat/libtiffto a version that resolves this vulnerability.Fixed in 4.4.0
Event History
Frequently Asked Questions
What is CVE-2022-2867?
CVE-2022-2867 is a vulnerability in libtiff's tiffcrop utility that allows for a uint32_t underflow, leading to out-of-bounds read and write.
How can the CVE-2022-2867 vulnerability be exploited?
An attacker can exploit CVE-2022-2867 by supplying a crafted file to tiffcrop, potentially tricking a user into running tiffcrop on it with certain parameters.
What is the severity of CVE-2022-2867?
CVE-2022-2867 has a severity level of medium (4) based on the CVSS scoring.
Which software versions are affected by CVE-2022-2867?
Versions up to and exclusive of 4.4.0 for libtiff on Red Hat, and versions up to and inclusive of 4.1.0+git191117-2~deb10u4 for tiff on Debian are affected.
How can I fix CVE-2022-2867?
To fix CVE-2022-2867, update to version 4.4.0 for libtiff on Red Hat, or to a version higher than 4.1.0+git191117-2~deb10u4 for tiff on Debian.