REDHAT-BUG-2142738: Medium severity LibTIFF libtiff vulnerability
LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json https://gitlab.com/libtiff/libtiff/-/issues/435 https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Fixed in 4.4.0Patch cfbb883b
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
An attacker must provide a crafted TIFF file that is processed by the affected code path in tiffcrop. Successful exploitation is described as causing a denial of service.
What can be done if a packaged fix is not yet available?
Users who compile LibTIFF from source can apply commit cfbb883bf6ea7bedcb04177cc4e52d304522fdff. Until then, avoid processing untrusted TIFF files with the affected tiffcrop functionality.
How can I identify a potentially affected source build?
The reported affected release is LibTIFF 4.4.0. For source-built installations, check whether commit cfbb883bf6ea7bedcb04177cc4e52d304522fdff or its equivalent fix is present.