CVE-2022-3599: Medium severity IBM Cognos Analytics vulnerability
LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
Other sources
LibTIFF is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the writeSingleSection function in tools/tiffcrop.c. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2~deb10u8Fixed in 4.2.0-1+deb11u4Fixed in 4.2.0-1+deb11u5Fixed in 4.5.0-6+deb12u1Fixed in 4.5.1+git230720-3 - Upgrade
Upgrade
libtiff/libtiffto a version that resolves this vulnerability.Fixed in 4.4.0 - Upgrade
Upgrade
libtiff/libtiffto a version that resolves this vulnerability.Patch e8131125
Event History
Frequently Asked Questions
What is CVE-2022-3599?
CVE-2022-3599 is a vulnerability in LibTIFF 4.4.0 that allows attackers to cause a denial-of-service via a crafted tiff file.
How can the LibTIFF vulnerability be exploited?
The LibTIFF vulnerability can be exploited by using a crafted tiff file to trigger an out-of-bounds read in the writeSingleSection function.
Who is affected by CVE-2022-3599?
Users of LibTIFF 4.4.0 are affected by CVE-2022-3599.
How can I fix the LibTIFF vulnerability?
For users that compile libtiff from sources, the fix is available with commit e8131125.
Where can I find more information about CVE-2022-3599?
You can find more information about CVE-2022-3599 in the references provided: [reference_1](https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246), [reference_2](https://gitlab.com/libtiff/libtiff/-/issues/398), [reference_3](https://security-tracker.debian.org/tracker/CVE-2022-3599).