CVE-2022-34526 — Out-of-bounds Write in Tiff

CWE-787 — Out-of-bounds WriteCWE-121 — Stack-based Buffer Overflow8 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 57.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Debian TiffDebian LinuxFedoraproject Fedora+7 more
Timeline
PublishedJul 29
Latest updateNov 8

Description

A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages8 packages

▶debiandebian/tiff< tiff 4.4.0-4 (bookworm)
▶NVDlibtiff/libtiff4.4.0

Also affects: Debian Linux 10.0, 11.0, Fedora 36

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

3
OSV
tiff vulnerabilities↗2022-11-08
▶
GHSA
GHSA-3fv6-vw38-4m6q: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4↗2022-07-30
▶
OSV
CVE-2022-34526: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4↗2022-07-29
▶

📋Vendor Advisories

4
Ubuntu
LibTIFF vulnerabilities↗2022-11-08
▶
Red Hat
libtiff: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit↗2022-07-30
▶
Microsoft
A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsp↗2022-07-12
▶
Debian
CVE-2022-34526: tiff - A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4...↗2022
▶