Out-of-bounds read in LibTIFF - CVE-2022-1622

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63826

Out-of-bounds read in LibTIFF - CVE-2022-1622

Published: May 31, 2022 / Updated: June 6, 2022


Vulnerability identifier: #VU63826
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1622
CWE-ID:
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary condition in LZWDecode() function in libtiff/tif_lzw.c:619. A remote attacker can create a specially crafted TIFF file, trick the victim into opening it, trigger out-of-bounds read error and to perform a denial of service attack.


Affected software

LibTIFF
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
macOS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
watchOS
iPadOS
Apple iOS
tvOS
Data Lakehouse
libtiff5-debuginfo-32bit
libtiff5
libtiff5-debuginfo
tiff
libtiff5-32bit
tiff-debugsource
tiff-debuginfo
libtiff-devel
libtiff-devel-32bit
libtiff5-32bit-debuginfo
tiff (Debian package)
libtiff-help
libtiff-debuginfo
libtiff-debugsource
libtiff
media-libs/tiff
Storage Resource Manager
Dell PowerProtect Cyber Recovery
Dell EMC Storage Monitoring and Reporting (SMR)

How to mitigate CVE-2022-1622

Install updates from vendor's website.

LibTIFF - update to 4.4.0
Data Lakehouse - update to 1.1.0.0
macOS - addressed in versions 11.7 20G817, 12.6 21G115, 13.0 22A380
libtiff5-debuginfo-32bit - update to 4.0.9-44.74.1
libtiff5 - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
libtiff5-debuginfo - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
tiff - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
libtiff5-32bit - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
tiff-debugsource - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
tiff-debuginfo - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
libtiff-devel - addressed in versions 4.0.9-44.74.1, 4.0.9-150000.45.35.1
libtiff-devel-32bit - update to 4.0.9-150000.45.35.1
libtiff5-32bit-debuginfo - update to 4.0.9-150000.45.35.1
tiff (Debian package) - update to 4.2.0-1+deb11u3
libtiff-help - update to 4.3.0-1
libtiff-devel - update to 4.3.0-1
libtiff-debuginfo - update to 4.3.0-1
libtiff-debugsource - update to 4.3.0-1
libtiff - update to 4.3.0-1
media-libs/tiff - update to 4.4.0
libtiff - addressed in versions 4.4.0-1.fc34, 4.4.0-1.fc35, 4.4.0-1.fc36
libtiff - update to 4.4.0-4
Storage Resource Manager - update to 4.10.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
watchOS - update to 9.0 20R361
iPadOS - update to 16.0 20A362
Apple iOS - update to 16.0 20A362
tvOS - update to 16.0 20J373
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

External References

Related Security Bulletins