Vulnerability · Published Mar 7, 2022 · Assigned by GitLab
CVE-2022-0865
Medium 5.5
In plain English
A medium-severity security flaw in libtiff from libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.5%top 26.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtiff | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff | 4.4.0-2.el9 | ALSA-2022:8194 |
| AlmaLinux:8 | libtiff-devel | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff-devel | 4.4.0-2.el9 | ALSA-2022:8194 |
| AlmaLinux:8 | libtiff-tools | 4.0.9-23.el8 | ALSA-2022:7585 |
| AlmaLinux:9 | libtiff-tools | 4.4.0-2.el9 | ALSA-2022:8194 |
| Alpine:v3.20 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0865 |
| Alpine:v3.21 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0865 |
| Alpine:v3.22 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0865 |
| Alpine:v3.23 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0865 |
| Alpine:v3.24 | tiff | 4.3.0-r1 | ALPINE-CVE-2022-0865 |
| Debian:12 | tiff | 4.3.0-5 | DEBIAN-CVE-2022-0865 |
| Debian:13 | tiff | 4.3.0-5 | DEBIAN-CVE-2022-0865 |
| Debian:14 | tiff | 4.3.0-5 | DEBIAN-CVE-2022-0865 |
| Rocky Linux:8 | libtiff | 0:4.0.9-23.el8 | RLSA-2022:7585 |
Affected products (as reported)
References
- https://gitlab.com/libtiff/libtiff/-/issues/385
- https://gitlab.com/libtiff/libtiff/-/merge_requests/306
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json
- DSA-5108 vendor-advisory
- FEDORA-2022-e2996202a0 vendor-advisory
- FEDORA-2022-c39720a0ed vendor-advisory
- GLSA-202210-10 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221228-0008/