REDHAT-BUG-2142736: Medium severity LibTIFF libtiff vulnerability
LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
References: https://gitlab.com/libtiff/libtiff/-/issues/413 https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3597.json
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch 236b7191f04c60d09ee836ae13b50f812c841047
Event History
Frequently Asked Questions
What component must process the malicious file for this issue to be triggered?
The vulnerable path is in the tiffcrop tool, specifically while extractImageSection processes a crafted TIFF file. Systems that do not use tiffcrop to process untrusted TIFF input are not described as exposed by the available information.
What is the impact of successful exploitation?
A crafted TIFF file can trigger an out-of-bounds write in _TIFFmemcpy and cause a denial of service. The provided information does not claim code execution or data disclosure.
What can source-build users do if a packaged update is not available?
Users compiling LibTIFF from source can apply commit 236b7191f04c60d09ee836ae13b50f812c841047, which is identified as the fix.