CVE-2022-2056 — Divide By Zero in Tiff

CWE-369 — Divide By Zero8 documents7 sources
Severity
6.5MEDIUMNVD
OSV7.5
EPSS
0.1%
top 74.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Debian TiffLibtiffDebian Linux+7 more
Timeline
PublishedJun 30
Latest updateSep 20

Description

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5libtiff/libtiff=4.4.0
▶NVDlibtiff/libtiff4.4.0
▶debiandebian/tiff< tiff 4.4.0-3 (bookworm)

Also affects: Debian Linux 10.0, 11.0, Fedora 35, 36

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

3
OSV
tiff vulnerabilities↗2022-09-20
▶
GHSA
GHSA-9q2x-2q4w-wffw: Divide By Zero error in tiffcrop in libtiff 4↗2022-07-01
▶
OSV
CVE-2022-2056: Divide By Zero error in tiffcrop in libtiff 4↗2022-06-30
▶

📋Vendor Advisories

4
Ubuntu
LibTIFF vulnerabilities↗2022-09-20
▶
Red Hat
libtiff: division by zero issues in tiffcrop↗2022-06-30
▶
Microsoft
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit f3↗2022-06-14
▶
Debian
CVE-2022-2056: tiff - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a de...↗2022
▶