REDHAT-BUG-2054494: Medium severity tiff vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to supply a crafted TIFF file that is processed by an affected libtiff version. Successful exploitation can cause a denial of service.

Q: Which libtiff versions are affected?

The issue affects libtiff versions from 3.9.0 through 4.3.0.

Q: What can source-built deployments do if a packaged update is unavailable?

Users who compile libtiff from source can apply commit eecb0712f4c3a5b449f70c57988260a667ddbdef, which is identified as the fix.

Published Feb 15, 2022

Updated

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json

Affected Software

1 affected component

LibTIFF libtiff>=3.9.0<=4.3.0

Event History

Feb 15, 2022

Data Sourced

via Red Hat·04:35 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to supply a crafted TIFF file that is processed by an affected libtiff version. Successful exploitation can cause a denial of service.

Which libtiff versions are affected?

The issue affects libtiff versions from 3.9.0 through 4.3.0.

What can source-built deployments do if a packaged update is unavailable?

Users who compile libtiff from source can apply commit eecb0712f4c3a5b449f70c57988260a667ddbdef, which is identified as the fix.

REDHAT-BUG-2054494: Medium severity tiff vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which libtiff versions are affected?

What can source-built deployments do if a packaged update is unavailable?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which libtiff versions are affected?

What can source-built deployments do if a packaged update is unavailable?