PT-2022-4779 · Libtiff+9 · Libtiff+9
Published
2022-03-11
·
Updated
2025-06-03
·
CVE-2022-0908
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libtiff versions up to 4.3.0
Description
The issue is related to a null source pointer being passed as an argument to the
memcpy() function within the TIFFFetchNormalTag() function in the tif dirread.c component of the LibTIFF library. This can lead to a Denial of Service when a specially crafted TIFF file is used. The vulnerability can be exploited by a remote attacker.Recommendations
For libtiff versions up to 4.3.0, update to a version later than 4.3.0 to resolve the issue.
As a temporary workaround, consider restricting the use of the
TIFFFetchNormalTag() function in the tif dirread.c component until a patch is available.
Avoid using specially crafted TIFF files that could exploit the null source pointer issue in the memcpy() function.Exploit
Fix
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Libtiff