Out-of-Bounds Read Vulnerability in LibTIFF 4.4.0 Affects Denial of Service
CVE-2022-4645

5.5MEDIUM

Key Information:

Vendor

Libtiff

Status
Libtiff
Vendor
CVE Published:
3 March 2023

What is CVE-2022-4645?

LibTIFF version 4.4.0 is vulnerable to an out-of-bounds read error located in the 'tiffcp' tool, specifically in the source file tools/tiffcp.c at line 948. This vulnerability allows attackers to execute a denial-of-service attack by providing a specially crafted TIFF file, which can disrupt service and render applications utilizing LibTIFF unresponsive. Users who compile LibTIFF from source code can apply the necessary fix by incorporating commit e8131125.

Affected Version(s)

libtiff <=4.4.0

References

https://gitlab.com/libtiff/libtiff/-/issues/277
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942...
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

[email protected]
.
CVE-2022-4645 : Out-of-Bounds Read Vulnerability in LibTIFF 4.4.0 Affects Denial of Service