CVE-2022-3597 - libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix

Back Back to CVE browser

MEDIUM

libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix

Published Oct 21, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 1.03%

Description

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.

Affected products

Vendor Libtiff Product Libtiff Default
n/a
- Version
  <=4.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Libtiff

n/a

Version	Status	Constraints
<=4.4.0	affected	-

Red Hat Enterprise Linux 9

libtiff-0:4.4.0-7.el9

Fixed · RHSA-2023:2340
Red Hat Enterprise Linux 6

libtiff

Out of support scope
Red Hat Enterprise Linux 7

compat-libtiff3

Out of support scope
Red Hat Enterprise Linux 7

libtiff

Out of support scope
Red Hat Enterprise Linux 8

compat-libtiff3

Not affected
Red Hat Enterprise Linux 8

libtiff

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 9	libtiff-0:4.4.0-7.el9	Fixed	RHSA-2023:2340
Red Hat Enterprise Linux 6	libtiff	Out of support scope	n/a
Red Hat Enterprise Linux 7	compat-libtiff3	Out of support scope	n/a
Red Hat Enterprise Linux 7	libtiff	Out of support scope	n/a
Red Hat Enterprise Linux 8	compat-libtiff3	Not affected	n/a
Red Hat Enterprise Linux 8	libtiff	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (10)

https://access.redhat.com/security/cve/CVE-2022-3597
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2142736
Issue Tracking
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3597.json
Third Party AdvisoryVDB Entry
https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047
Patch
https://gitlab.com/libtiff/libtiff/-/issues/413
ExploitIssue TrackingPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
mailing-listThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3597
https://security.netapp.com/advisory/ntap-20230110-0001/
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-3597
https://www.debian.org/security/2023/dsa-5333
vendor-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-3597		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2142736		Issue Tracking
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3597.json		Third Party AdvisoryVDB Entry
https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047		Patch
https://gitlab.com/libtiff/libtiff/-/issues/413		ExploitIssue TrackingPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html		mailing-listThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3597
https://security.netapp.com/advisory/ntap-20230110-0001/		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-3597
https://www.debian.org/security/2023/dsa-5333		vendor-advisoryThird Party Advisory