PT-2022-4777 · Libtiff+9 · Libtiff+9

[e-mail] · Published 2022-03-01 · Updated 2025-06-03 · CVE-2022-0865

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtiff version 4.3.0

Description The issue is related to a reachable assertion in tiffcp in libtiff, which allows attackers to cause a denial-of-service via a crafted tiff file. This can be exploited by a remote attacker to disrupt service using a specially crafted tiff file.

Recommendations For libtiff version 4.3.0, users who compile libtiff from sources can apply the fix available with commit 5e180045.

Exploit

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALSA-2022:7585

ALSA-2022:8194

ALT-PU-2022-2007

ALT-PU-2025-7532

AZL-8967

BDU:2022-05718

CESA-2022_7585

CVE-2022-0865

DSA-5108-1

MGASA-2022-0119

OESA-2022-1607

OPENSUSE-SU-2022_1882-1

OPENSUSE-SU-2024:12057-1

RHSA-2022:7585

RHSA-2022:8194

RHSA-2022_7585

RHSA-2022_8194

RLSA-2022:7585

SUSE-SU-2022:1667-1

SUSE-SU-2022:1882-1

SUSE-SU-2022_1667-1

USN-5421-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libtiff

References · 106

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0865.json · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/385 · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0865 · Security Note
• https://errata.almalinux.org/8/ALSA-2022-7585.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0865 · Security Note
• https://osv.dev/vulnerability/USN-5421-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5108 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12057-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0561 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0865 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8194.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-0865 · Vendor Advisory