PT-2022-4800 · Libtiff+4 · Libtiff+4
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff version 4.3.0
Description
The issue is related to errors in pointer dereferencing, allowing a remote attacker to cause a denial-of-service using a specially crafted tiff file. This can be achieved through the
tiffcrop function in libtiff. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.Recommendations
For libtiff version 4.3.0, users who compile libtiff from sources can apply the fix available with commit f2b656e2 to resolve the issue. As a temporary workaround, consider disabling the
tiffcrop function in libtiff until a patch is available.Exploit
Fix
DoS
NULL Pointer Dereference
Unchecked Return Value
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Ubuntu
Libtiff