Log in Start free

Vulnerability · Published Mar 9, 2022 · Assigned by GitLab

CVE-2022-0891

Medium 6.1

In plain English

A medium-severity security flaw in libtiff from libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libtiff4.0.9-23.el8ALSA-2022:7585
AlmaLinux:9libtiff4.4.0-2.el9ALSA-2022:8194
AlmaLinux:8libtiff-devel4.0.9-23.el8ALSA-2022:7585
AlmaLinux:9libtiff-devel4.4.0-2.el9ALSA-2022:8194
AlmaLinux:8libtiff-tools4.0.9-23.el8ALSA-2022:7585
AlmaLinux:9libtiff-tools4.4.0-2.el9ALSA-2022:8194
Alpine:v3.20tiff4.3.0-r1ALPINE-CVE-2022-0891
Alpine:v3.21tiff4.3.0-r1ALPINE-CVE-2022-0891
Alpine:v3.22tiff4.3.0-r1ALPINE-CVE-2022-0891
Alpine:v3.23tiff4.3.0-r1ALPINE-CVE-2022-0891
Alpine:v3.24tiff4.3.0-r1ALPINE-CVE-2022-0891
Debian:12tiff4.3.0-6DEBIAN-CVE-2022-0891
Debian:13tiff4.3.0-6DEBIAN-CVE-2022-0891
Debian:14tiff4.3.0-6DEBIAN-CVE-2022-0891
Rocky Linux:8libtiff0:4.0.9-23.el8RLSA-2022:7585

Affected products (as reported)

VendorProductVersions
libtiff libtiff >=3.9.0, <=4.3.0

References