Out-of-bounds write in LibTIFF - CVE-2022-3598

Vulnerability identifier: #VU68815

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3598

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing TIFF images within the extractContigSamplesShifted24bits() function in tools/tiffcrop.c. A remote attacker can pass a specially crafted TIFF image to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

LibTIFF
Amazon Linux AMI
Oracle Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
Ubuntu
openEuler
Data Lakehouse
IBM Watson Discovery for IBM Cloud Pak for Data
libtiff-tools (Ubuntu package)
libtiff5-debuginfo-32bit
libtiff5-32bit
tiff
libtiff5-debuginfo
libtiff5
tiff-debugsource
tiff-debuginfo
libtiff-devel
libtiff-help
libtiff
libtiff-debuginfo
libtiff-debugsource
libtiff (Red Hat package)
Tanzu Greenplum for Kubernetes
Dell PowerProtect Cyber Recovery
VMware Tanzu Operations Manager
HPE Moonshot 1500 Chassis Manager
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs

Install update from vendor's website.

Data Lakehouse - update to 1.1.0.0
libtiff-tools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.0.9-5ubuntu0.8, 4.1.0+git191117-2ubuntu0.20.04.6, 4.3.0-6ubuntu0.2, 4.4.0-4ubuntu3.1
Tanzu Greenplum for Kubernetes - update to 2.0.0
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
libtiff5-debuginfo-32bit - update to 4.0.9-44.62.1
libtiff5-32bit - update to 4.0.9-44.62.1
tiff - update to 4.0.9-44.62.1
libtiff5-debuginfo - update to 4.0.9-44.62.1
libtiff5 - update to 4.0.9-44.62.1
tiff-debugsource - update to 4.0.9-44.62.1
tiff-debuginfo - update to 4.0.9-44.62.1
libtiff-devel - update to 4.0.9-44.62.1
libtiff-help - update to 4.3.0-6
libtiff-devel - update to 4.3.0-6
libtiff - update to 4.3.0-6
libtiff-debuginfo - update to 4.3.0-6
libtiff-debugsource - update to 4.3.0-6
libtiff - update to 4.4.0-4
libtiff (Red Hat package) - update to 4.4.0-7.el9
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json
• https://gitlab.com/libtiff/libtiff/-/issues/435
• https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff

• Multiple vulnerabilities in LibTIFF
• Ubuntu update for tiff
• Ubuntu update for tiff
• SUSE update for tiff
• Red Hat Enterprise Linux 9 update for libtiff
• Multiple vulnerabilities in Oracle Linux
• VMware Tanzu products update for LibTIFF
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• openEuler update for libtiff
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Amazon Linux AMI update for libtiff
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Amazon Linux AMI update for libtiff