CVEvulnerability
CVE-2022-0891
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-03-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-787
Description
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Affected configurations
• libtiff libtiff (>= 3.9.0 <= 4.3.0)
• debian debian linux 10.0
• debian debian linux 11.0
• fedoraproject fedora 35
• fedoraproject fedora 36
• netapp active iq unified manager
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c Patch, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json Third Party Advisory, VDB Entry
- https://gitlab.com/libtiff/libtiff/-/issues/380 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://gitlab.com/libtiff/libtiff/-/issues/382 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202210-10 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221228-0008/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5108 Third Party Advisory
- https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c Patch, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json Third Party Advisory, VDB Entry
- https://gitlab.com/libtiff/libtiff/-/issues/380 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://gitlab.com/libtiff/libtiff/-/issues/382 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202210-10 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221228-0008/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5108 Third Party Advisory