REDHAT-BUG-2142742: Medium severity LibTIFF libtiff vulnerability
LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
References: https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047 https://gitlab.com/libtiff/libtiff/-/issues/411 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3627.json
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using LibTIFF 4.4.0 are exposed when they process attacker-controlled TIFF files through the affected tiffcrop code path, including extractImageSection.
What does an attacker need to exploit it?
An attacker needs to provide a crafted TIFF file that triggers the out-of-bounds write in _TIFFmemcpy. The described impact is denial of service.
What can be done if an updated package is not immediately available?
For environments that compile LibTIFF from source, apply commit 236b7191f04c60d09ee836ae13b50f812c841047. Until then, avoid processing untrusted TIFF files with the affected tooling.