REDHAT-BUG-2064146: Divide by Zero

Published Mar 15, 2022

Updated

Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.

https://gitlab.com/libtiff/libtiff/-/mergerequests/310 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0909.json

Affected Software

1 affected component

LibTIFF libtiff=4.3.0

Event History

Mar 15, 2022

Data Sourced

via Red Hat·07:14 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2064146?

The severity of REDHAT-BUG-2064146 is high due to its potential to cause a denial-of-service.

How do I fix REDHAT-BUG-2064146?

To fix REDHAT-BUG-2064146, users who compile libtiff from sources should apply the fix available in commit f8d0f9aa.

Which versions of libtiff are affected by REDHAT-BUG-2064146?

The affected version of libtiff for REDHAT-BUG-2064146 is 4.3.0.

Can attackers exploit REDHAT-BUG-2064146?

Yes, attackers can exploit REDHAT-BUG-2064146 by using a crafted TIFF file to cause a denial-of-service.

What component is responsible for the vulnerability in REDHAT-BUG-2064146?

The component responsible for the vulnerability in REDHAT-BUG-2064146 is the tiffcrop function in libtiff.