PT-2022-13622 · Libtiff+3 · Libtiff+3

Su_Laus + 1 · Published 2022-03-28 · Updated 2025-06-03 · CVE-2022-1056

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtiff version 4.3.0

Description The issue is an Out-of-bounds Read error in the tiffcrop function of libtiff, allowing attackers to cause a denial-of-service via a crafted tiff file.

Recommendations For version 4.3.0, the fix is available with commit 46dc8fcd for users that compile libtiff from sources.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2022-2007

ALT-PU-2025-7532

AZL-9187

CVE-2022-1056

OPENSUSE-SU-2022_1882-1

OPENSUSE-SU-2024:12057-1

SUSE-SU-2022:1667-1

SUSE-SU-2022:1882-1

SUSE-SU-2022_1667-1

Affected Products

Alt Linux

Debian

Suse

Libtiff

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1056.json · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/391 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1056 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1056 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12057-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1056 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-9187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1056 · Vendor Advisory
• https://gitlab.com/libtiff/libtiff/-/merge_requests/307 · Patch
• https://security.gentoo.org/glsa/202210-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1056 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1882-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1667-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1056 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1056 · Vendor Advisory