CVE-2022-34526: Buffer Overflow
A stack overflow was discovered in the TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.
Other sources
LibTIFF is vulnerable to a denial of service, caused by a stack-based buffer overflow in the TIFFVGetField function. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-34526?
CVE-2022-34526 is a stack overflow vulnerability in the _TIFFVGetField function of Tiffsplit v4.4.0.
How can attackers exploit CVE-2022-34526?
Attackers can exploit CVE-2022-34526 by using a crafted TIFF file parsed by the 'tiffsplit' or 'tiffcrop' utilities to cause a Denial of Service (DoS) attack.
What is the severity of CVE-2022-34526?
The severity of CVE-2022-34526 is not mentioned in the available information.
Which software versions are affected by CVE-2022-34526?
The affected software versions include tiffsplit v4.4.0 and possibly other versions specified in the referenced sources.
How can I fix CVE-2022-34526?
To fix CVE-2022-34526, update the 'tiff' package to version 4.5.1+git230720-1 or apply the appropriate remedy provided by the Debian source.