CVE-2022-0865 - libtiff: reachable assertion

Back Back to CVE browser

MEDIUM

libtiff: reachable assertion

Published Mar 7, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 1.48%

Description

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.

Affected products

Vendor Libtiff Product Libtiff Default
n/a
- Version
  =4.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Libtiff

n/a

Version	Status	Constraints
=4.3.0	affected	-

Red Hat Enterprise Linux 8

libtiff-0:4.0.9-23.el8

Fixed · RHSA-2022:7585
Red Hat Enterprise Linux 9

libtiff-0:4.4.0-2.el9

Fixed · RHSA-2022:8194
Red Hat Enterprise Linux 6

libtiff

Out of support scope
Red Hat Enterprise Linux 7

compat-libtiff3

Out of support scope
Red Hat Enterprise Linux 7

libtiff

Out of support scope
Red Hat Enterprise Linux 8

compat-libtiff3

Will not fix
Red Hat Enterprise Linux 8

mingw-libtiff

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	libtiff-0:4.0.9-23.el8	Fixed	RHSA-2022:7585
Red Hat Enterprise Linux 9	libtiff-0:4.4.0-2.el9	Fixed	RHSA-2022:8194
Red Hat Enterprise Linux 6	libtiff	Out of support scope	n/a
Red Hat Enterprise Linux 7	compat-libtiff3	Out of support scope	n/a
Red Hat Enterprise Linux 7	libtiff	Out of support scope	n/a
Red Hat Enterprise Linux 8	compat-libtiff3	Will not fix	n/a
Red Hat Enterprise Linux 8	mingw-libtiff	Will not fix	n/a

Remediation

Red Hat mitigation

Applications that do not parse files from untrusted/malicious sources will not be affected by this vulnerability.

Metrics

1.48% 0.01478

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.01478

Score over time

2022-2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (23 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	1.48% (0.01478)	72.98th	v5 (v2026.06.15)
Jun 15, 2026	1.49% (0.01490)	70.64th	v5 (v2026.06.15)
Mar 17, 2025	0.02% (0.00020)	2.99th	v4 (v2025.03.14)
Dec 12, 2024	0.66% (0.00655)	80.18th	v3 (v2023.03.01)
May 29, 2024	0.62% (0.00616)	78.74th	v3 (v2023.03.01)
Feb 8, 2024	0.31% (0.00306)	69.01th	v3 (v2023.03.01)
Nov 8, 2023	0.31% (0.00306)	66.45th	v3 (v2023.03.01)
Oct 27, 2023	0.42% (0.00421)	71.36th	v3 (v2023.03.01)
Sep 28, 2023	0.30% (0.00297)	65.74th	v3 (v2023.03.01)
Aug 18, 2023	0.28% (0.00276)	64.11th	v3 (v2023.03.01)
Jul 9, 2023	0.23% (0.00233)	60.33th	v3 (v2023.03.01)
Jun 12, 2023	0.16% (0.00162)	51.63th	v3 (v2023.03.01)
May 8, 2023	0.15% (0.00154)	50.23th	v3 (v2023.03.01)
Mar 14, 2023	0.17% (0.00174)	52.80th	v3 (v2023.03.01)
Mar 7, 2023	0.11% (0.00115)	43.56th	v3 (v2023.03.01)
Mar 6, 2023	1.18% (0.01183)	61.76th	v2 (v2022.01.01)
Dec 29, 2022	1.18% (0.01183)	61.03th	v2 (v2022.01.01)
Sep 17, 2022	1.11% (0.01108)	53.57th	v2 (v2022.01.01)
Apr 3, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Mar 26, 2022	1.02% (0.01018)	20.64th	v2 (v2022.01.01)
Mar 16, 2022	0.95% (0.00954)	17.27th	v2 (v2022.01.01)
Mar 8, 2022	0.89% (0.00890)	12.87th	v2 (v2022.01.01)

Weaknesses (1)

CWE-617

References (12)

https://access.redhat.com/security/cve/CVE-2022-0865
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064406
Issue Tracking
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json
Third Party AdvisoryVDB Entry
https://gitlab.com/libtiff/libtiff/-/issues/385
ExploitIssue TrackingPatchThird Party Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/306
ExploitIssue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0865
https://security.gentoo.org/glsa/202210-10
vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20221228-0008/
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0865
https://www.debian.org/security/2022/dsa-5108
vendor-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-0865		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064406		Issue Tracking
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json		Third Party AdvisoryVDB Entry
https://gitlab.com/libtiff/libtiff/-/issues/385		ExploitIssue TrackingPatchThird Party Advisory
https://gitlab.com/libtiff/libtiff/-/merge_requests/306		ExploitIssue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0865
https://security.gentoo.org/glsa/202210-10		vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20221228-0008/		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0865
https://www.debian.org/security/2022/dsa-5108		vendor-advisoryThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Mar 7, 2022

Updated Aug 2, 2024

Reserved Mar 4, 2022

Link CVE-2022-0865

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0865

Red Hat

Severity Moderate

Public date Mar 1, 2022

Links CVE-2022-0865 - Bugzilla