PT-2022-6892 · Libtiff+9 · Libtiff+9

Todd Cullum · Published 2022-06-07 · Updated 2025-06-03 · CVE-2022-2869

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtiff versions (affected versions not specified)

Description The issue is related to a uint32 t underflow in the tiffcrop tool of the libtiff library, leading to out of bounds read and write in the extractContigSamples8bits routine. An attacker could trigger this flaw by supplying a crafted file to tiffcrop, potentially causing a crash or further exploitation. This could be achieved by tricking a user into opening the crafted file with tiffcrop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-125

CWE-191

CWE-787

Related Identifiers

ALSA-2023:0095

ALT-PU-2022-2007

ALT-PU-2022-3428

ALT-PU-2025-7532

AZL-10593

BDU:2023-05416

CESA-2023_0095

CVE-2022-2869

DLA-3278-1

DSA-5333-1

MGASA-2022-0337

OESA-2022-1869

OPENSUSE-SU-2022_3690-1

OPENSUSE-SU-2024:13381-1

RHSA-2023:0095

RHSA-2023_0095

RLSA-2023:0095

ROSA-SA-2023-2264

SUSE-SU-2022:3679-1

SUSE-SU-2022:3690-1

USN-5604-1

USN-5714-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libtiff

References · 117

• https://osv.dev/vulnerability/MGASA-2022-0337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3597 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3627 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5604-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2869 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2953 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2867 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/683517 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2869 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05416 · Security Note
• https://ubuntu.com/security/CVE-2022-3570 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:0095 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5714-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5333 · Vendor Advisory