Vulnerability · Published Jun 30, 2022 · Assigned by GitLab
CVE-2022-2056
Medium 5.5
In plain English
A medium-severity security flaw in libtiff from libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.3%top 30.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libtiff | 4.0.9-26.el8_7 | ALSA-2023:0095 |
| AlmaLinux:9 | libtiff | 4.4.0-5.el9_1 | ALSA-2023:0302 |
| AlmaLinux:8 | libtiff-devel | 4.0.9-26.el8_7 | ALSA-2023:0095 |
| AlmaLinux:9 | libtiff-devel | 4.4.0-5.el9_1 | ALSA-2023:0302 |
| AlmaLinux:8 | libtiff-tools | 4.0.9-26.el8_7 | ALSA-2023:0095 |
| AlmaLinux:9 | libtiff-tools | 4.4.0-5.el9_1 | ALSA-2023:0302 |
| Alpine:v3.20 | tiff | 4.4.0-r1 | ALPINE-CVE-2022-2056 |
| Alpine:v3.21 | tiff | 4.4.0-r1 | ALPINE-CVE-2022-2056 |
| Alpine:v3.22 | tiff | 4.4.0-r1 | ALPINE-CVE-2022-2056 |
| Alpine:v3.23 | tiff | 4.4.0-r1 | ALPINE-CVE-2022-2056 |
| Alpine:v3.24 | tiff | 4.4.0-r1 | ALPINE-CVE-2022-2056 |
| Debian:12 | tiff | 4.4.0-3 | DEBIAN-CVE-2022-2056 |
| Debian:13 | tiff | 4.4.0-3 | DEBIAN-CVE-2022-2056 |
| Debian:14 | tiff | 4.4.0-3 | DEBIAN-CVE-2022-2056 |
| Rocky Linux:8 | libtiff | 0:4.0.9-26.el8_7 | RLSA-2023:0095 |
| Rocky Linux:9 | libtiff | 0:4.4.0-5.el9_1 | RLSA-2023:0302 |
| Ubuntu:22.04:LTS | tiff | 4.3.0-6ubuntu0.1 | USN-5619-1 |
| Ubuntu:22.04:LTS | tiff | 4.3.0-6ubuntu0.1 | UBUNTU-CVE-2022-2056 |
Affected products (as reported)
References
- https://gitlab.com/libtiff/libtiff/-/merge_requests/346
- https://gitlab.com/libtiff/libtiff/-/issues/415
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2056.json
- FEDORA-2022-edf7301147 vendor-advisory
- FEDORA-2022-b9c2a3a2b7 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220826-0001/
- [debian-lts-announce] 20230120 [SECURITY] [DLA 3278-1] tiff security update mailing-list
- DSA-5333 vendor-advisory