CVE-2022-2868: Input Validation
In libtiff's tiffcrop utility (tools/tiffcrop.c), a crafted file could supply an invalid cropwidth and/or croplength, and since these values were computed prior to the sanity check, invalid values could later cause out-of-bounds reads in reverseSamples16bits().
References: 1. https://gitlab.com/libtiff/libtiff/-/issues/335 2. https://gitlab.com/libtiff/libtiff/-/mergerequests/294/diffs?commitid=b258ed69a485a9cfb299d9f060eb2a46c54e5903
Other sources
LibTIFF is vulnerable to a denial of service, caused by improper validation of user supplied input that leads to an out-of-bounds read. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2~deb10u8Fixed in 4.2.0-1+deb11u4Fixed in 4.2.0-1+deb11u5Fixed in 4.5.0-6+deb12u1Fixed in 4.5.1+git230720-3 - Upgrade
Upgrade
redhat/libtiffto a version that resolves this vulnerability.Fixed in 4.4.0
Event History
Frequently Asked Questions
What is CVE-2022-2868?
CVE-2022-2868 is a vulnerability in libtiff's tiffcrop utility that allows for out of bounds read and can cause a crash if a crafted file is supplied to tiffcrop.
What is the severity of CVE-2022-2868?
The severity of CVE-2022-2868 is medium with a CVSS score of 5.5.
How does CVE-2022-2868 affect libtiff?
CVE-2022-2868 affects libtiff versions up to and exclusive of 4.4.0.
How do I fix CVE-2022-2868 on Red Hat?
To fix CVE-2022-2868 on Red Hat, update to libtiff version 4.4.0 or later.
How do I fix CVE-2022-2868 on Debian Linux?
To fix CVE-2022-2868 on Debian Linux, update to tiff version 4.1.0+git191117-2~deb10u8 or later.