PT-2022-6891 · Libtiff+9 · Libtiff+9

Todd Cullum · Published 2022-06-07 · Updated 2025-06-03 · CVE-2022-2867

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtiff (affected versions not specified)

Description The issue is related to a uint32 t underflow in libtiff's tiffcrop utility, which can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop could cause a crash or potentially further exploitation. This can be achieved by tricking a user into running tiffcrop on the crafted file with specific parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-125

CWE-191

CWE-787

Related Identifiers

ALSA-2023:0095

ALT-PU-2022-2007

ALT-PU-2022-3428

ALT-PU-2025-7532

AZL-10567

BDU:2023-05415

CESA-2023_0095

CVE-2022-2867

DLA-3278-1

DSA-5333-1

MGASA-2022-0337

OESA-2022-1869

OPENSUSE-SU-2022_3690-1

OPENSUSE-SU-2024:13381-1

RHSA-2023:0095

RHSA-2023_0095

RLSA-2023:0095

SUSE-SU-2022:3679-1

SUSE-SU-2022:3690-1

USN-5604-1

USN-5714-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libtiff

References · 117

• https://osv.dev/vulnerability/MGASA-2022-0337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3597 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3627 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2867 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5604-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2953 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2867 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/683517 · Security Note
• https://ubuntu.com/security/CVE-2022-3570 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10567 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:0095 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5714-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5333 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1869 · Vendor Advisory