First published: Fri Oct 21 2022(Updated: )
LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.
Credit: cve@gitlab.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/tiff | <=4.1.0+git191117-2~deb10u4 | 4.1.0+git191117-2~deb10u8 4.2.0-1+deb11u4 4.2.0-1+deb11u5 4.5.0-6+deb12u1 4.5.1+git230720-3 |
Libtiff Libtiff | <=4.4.0 | |
Netapp Active Iq Unified Manager Vmware Vsphere | ||
Debian Debian Linux | =10.0 | |
IBM Cognos Analytics | <=12.0.0-12.0.3 | |
IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-3598 is a vulnerability in LibTIFF 4.4.0 that allows for an out-of-bounds write, leading to a denial-of-service when processing a crafted TIFF file.
CVE-2022-3598 has a severity rating of 6.5 (Medium).
To fix CVE-2022-3598, users that compile libtiff from sources can apply the fix available with commit cfbb883b.
LibTIFF versions up to and including 4.4.0 are affected by CVE-2022-3598.
Yes, here are some references for CVE-2022-3598: [link1] [link2] [link3]