REDHAT-BUG-2142741: Medium severity LibTIFF libtiff vulnerability
LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemset in libtiff/tifunix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3626.json https://gitlab.com/libtiff/libtiff/-/issues/426 https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libtiffto a version that resolves this vulnerability.Patch 236b7191f04c60d09ee836ae13b50f812c841047
Event History
Frequently Asked Questions
Which processing path is implicated by this issue?
The affected path is processCropSelections in the tiffcrop tool, which reaches _TIFFmemset in libtiff/tif_unix.c. Systems that use tiffcrop to process untrusted TIFF files are the relevant exposure scenario.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a crafted TIFF file that is processed through the affected tiffcrop code path. The documented impact is denial of service.
What can source-built deployments do if they cannot wait for a packaged update?
Users compiling LibTIFF from source can apply the fix in commit 236b7191f04c60d09ee836ae13b50f812c841047.