Input validation error in LibTIFF - CVE-2022-1210

Vulnerability identifier: #VU62058

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1210

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the TIFF File Handler of tiff2ps. A remote attacker can trick a victim to open a specially crafted TIFF file and perform a denial of service (DoS) attack.

LibTIFF
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Basesystem Module
openSUSE Leap
jbigkit-debuginfo
jbigkit-debugsource
libjbig-devel
libjbig2
libjbig2-debuginfo
libjbig2-debuginfo-32bit
libjbig2-32bit
jbigkit
libjbig2-32bit-debuginfo
libjbig-devel-32bit
media-libs/tiff
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

LibTIFF - update to 4.6.1
jbigkit-debuginfo - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
jbigkit-debugsource - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
libjbig-devel - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
libjbig2 - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
libjbig2-debuginfo - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
libjbig2-debuginfo-32bit - update to 2.0-14.3.1
libjbig2-32bit - addressed in versions 2.0-14.3.1, 2.1-150000.3.5.1
jbigkit - update to 2.1-21
jbigkit - update to 2.1-150000.3.5.1
libjbig2-32bit-debuginfo - update to 2.1-150000.3.5.1
libjbig-devel-32bit - update to 2.1-150000.3.5.1
media-libs/tiff - update to 4.4.0
Storage Resource Manager - update to 4.10.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3

• https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff
• https://gitlab.com/libtiff/libtiff/-/issues/402
• https://vuldb.com/?id.196363

• Denial of service in LibTIFF
• Gentoo update for LibTIFF
• SUSE update for jbigkit
• SUSE update for jbigkit
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• SUSE update for jbigkit
• Amazon Linux AMI update for jbigkit