Vulnerability · Published Mar 11, 2022 · Assigned by GitLab
CVE-2022-0924
Medium 5.5
In plain English
A medium-severity security flaw in libtiff from libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.3%top 28.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtiff | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff | 4.4.0-2.el9 | ALSA-2022:8194 |
| AlmaLinux:8 | libtiff-devel | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff-devel | 4.4.0-2.el9 | ALSA-2022:8194 |
| AlmaLinux:8 | libtiff-tools | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff-tools | 4.4.0-2.el9 | ALSA-2022:8194 |
| Alpine:v3.20 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0924 |
| Alpine:v3.21 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0924 |
| Alpine:v3.22 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0924 |
| Alpine:v3.23 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0924 |
| Alpine:v3.24 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0924 |
| Debian:12 | tiff | 4.3.0-6 | DEBIAN-CVE-2022-0924 |
| Debian:13 | tiff | 4.3.0-6 | DEBIAN-CVE-2022-0924 |
| Debian:14 | tiff | 4.3.0-6 | DEBIAN-CVE-2022-0924 |
| Rocky Linux:8 | libtiff | 0:4.0.9-23.el8 | RLSA-2022:7585 |
Affected products (as reported)
References
- https://gitlab.com/libtiff/libtiff/-/issues/278
- https://gitlab.com/libtiff/libtiff/-/merge_requests/311
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0924.json
- DSA-5108 vendor-advisory
- FEDORA-2022-e2996202a0 vendor-advisory
- FEDORA-2022-c39720a0ed vendor-advisory
- https://security.netapp.com/advisory/ntap-20220506-0002/
- GLSA-202210-10 vendor-advisory