Vulnerability · Published Nov 13, 2022 · Assigned by VulDB
CVE-2022-3970LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow
Medium 6.3
In plain English
A medium-severity security flaw in LibTIFF from unspecified. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtiff | 4.0.9-27.el8 | ALSA-2023:2883 |
| AlmaLinux:9 | libtiff | 4.4.0-7.el9 | ALSA-2023:2340 |
| AlmaLinux:8 | libtiff-devel | 4.0.9-27.el8 | ALSA-2023:2883 |
| AlmaLinux:9 | libtiff-devel | 4.4.0-7.el9 | ALSA-2023:2340 |
| AlmaLinux:8 | libtiff-tools | 4.0.9-27.el8 | ALSA-2023:2883 |
| AlmaLinux:9 | libtiff-tools | 4.4.0-7.el9 | ALSA-2023:2340 |
| Alpine:v3.20 | tiff | 4.5.0-r0 | ALPINE-CVE-2022-3970 |
| Alpine:v3.21 | tiff | 4.5.0-r0 | ALPINE-CVE-2022-3970 |
| Alpine:v3.22 | tiff | 4.5.0-r0 | ALPINE-CVE-2022-3970 |
| Alpine:v3.23 | tiff | 4.5.0-r0 | ALPINE-CVE-2022-3970 |
| Alpine:v3.24 | tiff | 4.5.0-r0 | ALPINE-CVE-2022-3970 |
| Debian:12 | tiff | 4.4.0-6 | DEBIAN-CVE-2022-3970 |
| Debian:13 | tiff | 4.4.0-6 | DEBIAN-CVE-2022-3970 |
| Debian:14 | tiff | 4.4.0-6 | DEBIAN-CVE-2022-3970 |
| Ubuntu:22.04:LTS | tiff | 4.3.0-6ubuntu0.3 | UBUNTU-CVE-2022-3970 |
| Ubuntu:22.04:LTS | tiff | 4.3.0-6ubuntu0.3 | USN-5743-2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| unspecified | LibTIFF | n/a |
Weakness: CWE-189 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137
- https://oss-fuzz.com/download?testcase_id=5738253143900160
- https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be
- https://vuldb.com/?id.213549
- https://security.netapp.com/advisory/ntap-20221215-0009/
- [debian-lts-announce] 20230120 [SECURITY] [DLA 3278-1] tiff security update mailing-list
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213841