PT-2022-4778 · Libtiff+9 · Libtiff+9

4Ugustus + 1 · Published 2022-03-11 · Updated 2025-06-03 · CVE-2022-0909

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtiff version 4.3.0

Description The issue is related to a Divide By Zero error in the tiffcrop function of libtiff, which allows attackers to cause a denial-of-service via a crafted tiff file. This can be exploited by a remote attacker to disrupt service.

Recommendations For libtiff version 4.3.0, the fix is available with commit f8d0f9aa for users who compile libtiff from sources.

Exploit

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALSA-2022:7585

ALSA-2022:8194

ALT-PU-2022-2007

ALT-PU-2025-7532

AZL-9022

BDU:2022-05719

CESA-2022_7585

CVE-2022-0909

DSA-5108-1

MGASA-2022-0119

OESA-2022-1607

OPENSUSE-SU-2022_1882-1

OPENSUSE-SU-2024:12057-1

RHSA-2022:7585

RHSA-2022:8194

RHSA-2022_7585

RHSA-2022_8194

RLSA-2022:7585

SUSE-SU-2022:1667-1

SUSE-SU-2022:1882-1

SUSE-SU-2022_1667-1

USN-5523-1

USN-5523-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libtiff

References · 108

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0909.json · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/393 · Exploit
• https://osv.dev/vulnerability/AZL-9022 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-19144 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0909 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7585.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0909 · Vendor Advisory
• https://debian.org/security/2022/dsa-5108 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12057-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0865 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-0909 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0907 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8194.html · Vendor Advisory