CVE-2022-0865 — Reachable Assertion in Tiff

CWE-617 — Reachable Assertion8 documents7 sources
Severity
6.5MEDIUMNVD
OSV5.5
EPSS
0.0%
top 89.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Debian TiffLibtiffDebian Linux+2 more
Timeline
PublishedMar 10
Latest updateMay 16

Description

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5libtiff/libtiff=4.3.0
▶NVDlibtiff/libtiff4.3.0
▶debiandebian/tiff< tiff 4.3.0-5 (bookworm)

Also affects: Debian Linux 10.0, 11.0, Fedora 36

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

3
OSV
tiff vulnerabilities↗2022-05-16
▶
GHSA
GHSA-6x45-qmh6-q92p: Reachable Assertion in tiffcp in libtiff 4↗2022-03-11
▶
OSV
CVE-2022-0865: Reachable Assertion in tiffcp in libtiff 4↗2022-03-10
▶

📋Vendor Advisories

4
Ubuntu
LibTIFF vulnerabilities↗2022-05-16
▶
Microsoft
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit 5e180↗2022-03-08
▶
Red Hat
libtiff: reachable assertion↗2022-03-01
▶
Debian
CVE-2022-0865: tiff - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denia...↗2022
▶