PT-2022-4785 · Libtiff+9 · Libtiff+9

4Ugustus + 1 · Published 2022-03-11 · Updated 2025-06-03 · CVE-2022-0924

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtiff version 4.3.0

Description The issue is related to an out-of-bounds read error in the tiffcp component of libtiff, which allows attackers to cause a denial-of-service via a crafted tiff file. This can be exploited by a remote attacker to disrupt service.

Recommendations For version 4.3.0, users who compile libtiff from sources can apply the fix available with commit 408976c4.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2022:7585

ALSA-2022:8194

ALT-PU-2022-2007

ALT-PU-2025-7532

AZL-9023

BDU:2022-05726

CESA-2022_7585

CVE-2022-0924

DSA-5108-1

MGASA-2022-0119

OESA-2022-1607

OPENSUSE-SU-2022_1882-1

OPENSUSE-SU-2024:12057-1

RHSA-2022:7585

RHSA-2022:8194

RHSA-2022_7585

RHSA-2022_8194

RLSA-2022:7585

SUSE-SU-2022:1667-1

SUSE-SU-2022:1882-1

SUSE-SU-2022_1667-1

USN-5523-1

USN-5523-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libtiff

References · 111

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0924.json · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/278 · Exploit
• https://ubuntu.com/security/CVE-2020-19144 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0924 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7585.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0924 · Vendor Advisory
• https://debian.org/security/2022/dsa-5108 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1607 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12057-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0865 · Security Note
• https://ubuntu.com/security/CVE-2022-0907 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0924 · Security Note
• https://osv.dev/vulnerability/AZL-9023 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0924 · Vendor Advisory