Heap-based buffer overflow in LibTIFF - CVE-2022-48281

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71620

Heap-based buffer overflow in LibTIFF - CVE-2022-48281

Published: January 30, 2023 / Updated: June 15, 2023


Vulnerability identifier: #VU71620
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-48281
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the processCropSelections() function in tools/tiffcrop.c in LibTIFF. A remote attacker can pass a specially crafted TIFF image to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

LibTIFF
Amazon Linux AMI
Debian Linux
Gentoo Linux
Oracle Linux
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Anolis OS
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Data Lakehouse
Red Hat OpenShift Dev Spaces
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Security Verify Governance
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
HPE Moonshot 1500 Chassis Manager
SUSE Linux Enterprise Module for Packagehub Subpackages
libtiff5 (Ubuntu package)
libtiff-tools (Ubuntu package)
libtiff (Red Hat package)
libtiff5
libtiff5-debuginfo-32bit
libtiff5-debuginfo
tiff
tiff-debuginfo
tiff-debugsource
libtiff-devel
libtiff5-32bit
libtiff-devel-32bit
libtiff5-32bit-debuginfo
tiff (Debian package)
libtiff-help
libtiff-debugsource
libtiff-debuginfo
libtiff
media-libs/tiff
libtiff6 (Ubuntu package)
Robotic Process Automation for Cloud Pak
Dell PowerProtect Cyber Recovery
VMware Tanzu Operations Manager
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
RecoverPoint for VMs

How to mitigate CVE-2022-48281

Install update from vendor's website.

Data Lakehouse - update to 1.1.0.0
OpenShift API for Data Protection (OADP) - addressed in versions 1.0.11, 1.1.6
Migration Toolkit for Containers - update to 1.7.12
Red Hat OpenShift Dev Spaces - update to 3.7.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
libtiff5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.1.0+git191117-2ubuntu0.20.04.9, 4.3.0-6ubuntu0.5
libtiff-tools (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.1.0+git191117-2ubuntu0.20.04.9, 4.3.0-6ubuntu0.5, 4.5.0-5ubuntu1.1
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
Isolation Segment - addressed in versions 2.11.38, 2.13.23, 3.0.16, 4.0.8
VMware Tanzu Application Service for VMs - addressed in versions 2.11.44, 2.13.26, 3.0.16, 4.0.8
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
libtiff (Red Hat package) - addressed in versions 4.0.9-28.el8_8, 4.4.0-8.el9_2
libtiff5 - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
libtiff5-debuginfo-32bit - update to 4.0.9-44.65.1
libtiff5-debuginfo - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
tiff - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
tiff-debuginfo - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
tiff-debugsource - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
libtiff-devel - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
libtiff5-32bit - addressed in versions 4.0.9-44.65.1, 4.0.9-150000.45.25.1
libtiff-devel-32bit - update to 4.0.9-150000.45.25.1
libtiff5-32bit-debuginfo - update to 4.0.9-150000.45.25.1
tiff (Debian package) - update to 4.2.0-1+deb11u3
libtiff-help - update to 4.3.0-8
libtiff-debugsource - update to 4.3.0-8
libtiff-devel - update to 4.3.0-8
libtiff-debuginfo - update to 4.3.0-8
libtiff - update to 4.3.0-8
libtiff - update to 4.4.0-4
libtiff-devel - update to 4.4.0-8.0.1
libtiff - update to 4.4.0-8.0.1
media-libs/tiff - update to 4.5.0-r2
libtiff6 (Ubuntu package) - update to 4.5.0-5ubuntu1.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.1
EMC ViPR SRM - update to 4.9.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
App Connect Enterprise Certified Container - addressed in versions 5.0.9, 9.1.0
RecoverPoint for VMs - update to 6.0.SP1.P1
IBM Security Verify Governance - update to 10.0.2.0.4
Dell PowerProtect Cyber Recovery - update to 19.14.0.1

External References

Related Security Bulletins