REDHAT-BUG-2176220: Medium severity tiff vulnerability
LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
References: https://gitlab.com/libtiff/libtiff/-/issues/277 https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4645.json
Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2176220?
The severity of REDHAT-BUG-2176220 is critical due to the potential for denial-of-service attacks.
How do I fix REDHAT-BUG-2176220?
To fix REDHAT-BUG-2176220, users who compile libtiff from sources should apply the fix available with commit e8131125.
What component is affected by REDHAT-BUG-2176220?
REDHAT-BUG-2176220 affects the LibTIFF library, specifically the tiffcp tool.
What type of vulnerability is REDHAT-BUG-2176220?
REDHAT-BUG-2176220 is an out-of-bounds read vulnerability that can lead to denial-of-service.
Who can be impacted by REDHAT-BUG-2176220?
Any user or application relying on the vulnerable version of LibTIFF for processing TIFF files can be impacted by REDHAT-BUG-2176220.