Log in Start free

Vulnerability · Published Aug 31, 2022 · Assigned by redhat

CVE-2022-2519

Medium 6.5

In plain English

A medium-severity double free in libtiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.3%top 28.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libtiff4.0.9-26.el8_7ALSA-2023:0095
AlmaLinux:9libtiff4.4.0-5.el9_1ALSA-2023:0302
AlmaLinux:8libtiff-devel4.0.9-26.el8_7ALSA-2023:0095
AlmaLinux:9libtiff-devel4.4.0-5.el9_1ALSA-2023:0302
AlmaLinux:8libtiff-tools4.0.9-26.el8_7ALSA-2023:0095
AlmaLinux:9libtiff-tools4.4.0-5.el9_1ALSA-2023:0302
Alpine:v3.20tiff4.4.0-r1ALPINE-CVE-2022-2519
Alpine:v3.21tiff4.4.0-r1ALPINE-CVE-2022-2519
Alpine:v3.22tiff4.4.0-r1ALPINE-CVE-2022-2519
Alpine:v3.23tiff4.4.0-r1ALPINE-CVE-2022-2519
Alpine:v3.24tiff4.4.0-r1ALPINE-CVE-2022-2519
Debian:12tiff4.4.0-6DEBIAN-CVE-2022-2519
Debian:13tiff4.4.0-6DEBIAN-CVE-2022-2519
Debian:14tiff4.4.0-6DEBIAN-CVE-2022-2519
Rocky Linux:8libtiff0:4.0.9-26.el8_7RLSA-2023:0095
Rocky Linux:9libtiff0:4.4.0-5.el9_1RLSA-2023:0302

Affected products (as reported)

VendorProductVersions
n/a libtiff libtiff 4.4.0rc1

Weakness: CWE-415

References