PT-2023-4908 · Libtiff+6 · Libtiff+6

4Ugustus + 1 · Published 2023-01-29 · Updated 2025-06-26 · CVE-2022-4645

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibTIFF version 4.4.0

Description The issue is related to an out-of-bounds read in the tiffcp utility, located in tools/tiffcp.c:948, which can be exploited by attackers to cause a denial-of-service via a crafted tiff file. This can lead to a disruption in service.

Recommendations For LibTIFF version 4.4.0, users who compile libtiff from sources can apply the fix available with commit e8131125 to resolve the issue. As a temporary workaround, consider restricting the use of the tiffcp utility until the fix is applied.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2023:2340

ALSA-2024:3059

ALSA-2024_3059

ALT-PU-2025-7185

ALT-PU-2025-7532

ALT-PU-2025-8255

AZL-13826

AZL-43561

AZL-44667

BDU:2023-05401

CESA-2024_3059

CVE-2022-4645

DSA-5333-1

INFSA-2024_3059

MGASA-2023-0113

RHSA-2023:2340

RHSA-2023_2340

RHSA-2024:3059

RHSA-2024_3059

RLSA-2024:3059

ROSA-SA-2025-2627

ROSA-SA-2025-2657

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Libtiff

Red Hat

Rocky Linux

References · 69

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4645.json · Exploit
• 🔥 https://github.com/xiaoqx/pocs/tree/master/libtiff · Exploit
• 🔥 https://github.com/halfbitteam/POCs/tree/master/libtiff-4.08_tiff2ps_heap_overflow · Exploit
• 🔥 https://gitlab.com/libtiff/libtiff/-/issues/277 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLM763GGZVVOAXIQXG6YGTYJ5VFYNECQ · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2340.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA6GRCAQ7NR2OK5N44UQRGUJBIYKWJJH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4645 · Security Note
• https://errata.almalinux.org/8/ALSA-2024-3059.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4645 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:3059 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43561 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4645 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0113 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05401 · Security Note