PT-2022-4138 · Libtiff+1 · Libtiff+1
John Helmert Iii
·
Published
2022-06-21
·
Updated
2025-09-30
·
CVE-2022-34266
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
LibTIFF version 4.0.3-35.amzn2.0.1
Description
The issue is related to the processing of malicious TIFF files, which can cause a denial of service (application crash). Specifically, an invalid range may be passed as an argument to the
memset() function within the TIFFFetchStripThing() function in tif dirread.c, leading to a segfault after the use of an uninitialized resource. This occurs when the TIFFFetchStripThing() function is used to handle TIFF files, potentially allowing an attacker to exploit the vulnerability and cause a service disruption.Recommendations
For LibTIFF version 4.0.3-35.amzn2.0.1, consider avoiding the use of the
TIFFFetchStripThing() function until a patch is available, or restrict access to the tif dirread.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Libtiff
Suse