PT-2022-6889 · Libtiff+7 · Libtiff+7

4Ugustus + 1 · Published 2022-10-21 · Updated 2025-06-19 · CVE-2022-3599

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.4.0

Description The issue is related to an out-of-bounds read in the writeSingleSection function of the LibTIFF library, which can be exploited by attackers to cause a denial-of-service via a crafted tiff file.

Recommendations For version 4.4.0, users who compile libtiff from sources can apply the fix available with commit e8131125.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2023:2340

ALT-PU-2022-3360

ALT-PU-2022-3428

ALT-PU-2025-7185

ALT-PU-2025-7532

AZL-11286

AZL-44103

BDU:2023-05413

CVE-2022-3599

DLA-3278-1

DSA-5333-1

MGASA-2022-0424

OESA-2022-2020

OPENSUSE-SU-2022_4259-1

OPENSUSE-SU-2024:12510-1

RHSA-2023:2340

RHSA-2023_2340

SUSE-SU-2022:4248-1

SUSE-SU-2022:4259-1

USN-5714-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Libtiff

Linuxmint

Red Hat

Suse

Ubuntu

References · 99

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3599.json · Exploit
• 🔥 https://github.com/xiaoqx/pocs/tree/master/libtiff · Exploit
• 🔥 https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/398 · Exploit
• https://ubuntu.com/security/CVE-2022-2869 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3597 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2953 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3598 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0424 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3570 · Security Note
• https://ubuntu.com/security/CVE-2022-2867 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5714-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3627 · Security Note