CVE-2022-4645: Medium severity ibm cognos analytics vulnerability
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
Other sources
LibTIFF is vulnerable to a denial of service, caused by an out-of-bounds read flaw in the tiffcp function in tools/tiffcp.c. By using a specially-crafted tiff file, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-4645?
CVE-2022-4645 is a vulnerability in LibTIFF 4.4.0 that allows attackers to cause a denial-of-service via a crafted tiff file.
How severe is CVE-2022-4645?
CVE-2022-4645 has a severity value of 5.5, which is considered medium.
How can attackers exploit CVE-2022-4645?
Attackers can exploit CVE-2022-4645 by using a crafted tiff file to trigger an out-of-bounds read in tiffcp, resulting in a denial-of-service.
What software versions are affected by CVE-2022-4645?
Versions up to and including LibTIFF 4.4.0 are affected by CVE-2022-4645.
How can I fix CVE-2022-4645?
If you compile libtiff from sources, you can apply the fix with commit e8131125.