libtiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c
Published Aug 17, 2022
5.5
MEDIUMCVSS 3.1
EPSS 0.32%
Description
libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.
Affected products
- Vendor n/a Product Libtiff Defaultn/a
- Version libtiff 4.4.0rc1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Libtiff | n/a |
|
Configuration 2
- 35
- 36
Configuration 3
- 10.0
- 11.0
No data.
Red Hat Enterprise Linux 8
libtiff-0:4.0.9-26.el8_7
Fixed · RHSA-2023:0095
Red Hat Enterprise Linux 6
libtiff
Out of support scope
Red Hat Enterprise Linux 7
compat-libtiff3
Out of support scope
Red Hat Enterprise Linux 7
libtiff
Out of support scope
Red Hat Enterprise Linux 8
compat-libtiff3
Will not fix
Red Hat Enterprise Linux 9
libtiff
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | libtiff-0:4.0.9-26.el8_7 | Fixed | RHSA-2023:0095 |
| Red Hat Enterprise Linux 6 | libtiff | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | compat-libtiff3 | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | libtiff | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | compat-libtiff3 | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | libtiff | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This flaw has been rated as a Moderate because it is present in the tiffcrop utility rather than the libtiff library itself.
References (6)
- https://access.redhat.com/security/cve/CVE-2022-2867 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2118847 Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html mailing-listMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-2867
- https://www.cve.org/CVERecord?id=CVE-2022-2867
- https://www.debian.org/security/2023/dsa-5333 vendor-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-2867 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2118847 | Issue TrackingPatchThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html | mailing-listMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-2867 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-2867 | ||
| https://www.debian.org/security/2023/dsa-5333 | vendor-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.