PT-2022-4806 · Libtiff+9 · Libtiff+9
CVSS v2.0
7.8
High
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libtiff library version 4.3.0
Description
A heap buffer overflow in the
ExtractImageSection function in tiffcrop.c allows an attacker to trigger unsafe or out of bounds memory access via a crafted TIFF image file, which could result in an application crash, potential information disclosure, or any other context-dependent impact.Recommendations
For libtiff library version 4.3.0, consider updating to a newer version that contains a fix for this issue, as using a crafted TIFF image file could lead to application crash or information disclosure. As a temporary workaround, consider restricting the use of the
ExtractImageSection function in tiffcrop.c until a patch is available. Avoid using the tiffcrop.c component with untrusted TIFF image files until the issue is resolved.Exploit
Fix
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Libtiff