7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P
0.006 Low
EPSS
Percentile
78.8%
Severity: High
Date : 2022-04-05
CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891
CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924
CVE-2022-22844
Package : libtiff
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2658
The package libtiff before version 4.3.0-2 is vulnerable to multiple
issues including arbitrary code execution and denial of service.
Upgrade to 4.3.0-2.
The problems have been fixed upstream but no release is available yet.
None.
Null source pointer passed as an argument to memcpy() function within
TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0
to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Null source pointer passed as an argument to memcpy() function within
TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to
4.3.0 could lead to Denial of Service via crafted TIFF file.
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in
libtiff library Version 4.3.0 allows attacker to trigger unsafe or out
of bounds memory access via crafted TIFF image file which could result
into application crash, potential information disclosure or any other
context-dependent impact.
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in
libtiff 4.3.0 allows attackers to cause a denial-of-service via a
crafted tiff file.
Null source pointer passed as an argument to memcpy() function within
TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0
could lead to Denial of Service via crafted TIFF file.
A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers
to cause a denial-of-service via a crafted tiff file.
Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to
cause a denial-of-service via a crafted tiff file.
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in
certain situations involving a custom tag and 0x0200 as the second word
of the DE field.
A remote attacker is able to crash the application or execute arbitrary
code on the affected host via a crafted tiff file.
https://bugs.archlinux.org/task/74229
https://gitlab.com/libtiff/libtiff/-/issues/362
https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b
https://gitlab.com/libtiff/libtiff/-/issues/385
https://gitlab.com/libtiff/libtiff/-/merge_requests/306
https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067
https://gitlab.com/libtiff/libtiff/-/issues/380
https://gitlab.com/libtiff/libtiff/-/issues/382
https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
https://gitlab.com/libtiff/libtiff/-/issues/392
https://gitlab.com/libtiff/libtiff/-/merge_requests/314
https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc
https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85
https://gitlab.com/libtiff/libtiff/-/issues/383
https://gitlab.com/libtiff/libtiff/-/issues/393
https://gitlab.com/libtiff/libtiff/-/merge_requests/310
https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde
https://gitlab.com/libtiff/libtiff/-/issues/278
https://gitlab.com/libtiff/libtiff/-/merge_requests/311
https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a
https://gitlab.com/libtiff/libtiff/-/issues/355
https://gitlab.com/libtiff/libtiff/-/merge_requests/287
https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64
https://security.archlinux.org/CVE-2022-0561
https://security.archlinux.org/CVE-2022-0562
https://security.archlinux.org/CVE-2022-0865
https://security.archlinux.org/CVE-2022-0891
https://security.archlinux.org/CVE-2022-0907
https://security.archlinux.org/CVE-2022-0908
https://security.archlinux.org/CVE-2022-0909
https://security.archlinux.org/CVE-2022-0924
https://security.archlinux.org/CVE-2022-22844
bugs.archlinux.org/task/74229
gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64
gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde
gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc
gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b
gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a
gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067
gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85
gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
gitlab.com/libtiff/libtiff/-/issues/278
gitlab.com/libtiff/libtiff/-/issues/355
gitlab.com/libtiff/libtiff/-/issues/362
gitlab.com/libtiff/libtiff/-/issues/380
gitlab.com/libtiff/libtiff/-/issues/382
gitlab.com/libtiff/libtiff/-/issues/383
gitlab.com/libtiff/libtiff/-/issues/385
gitlab.com/libtiff/libtiff/-/issues/392
gitlab.com/libtiff/libtiff/-/issues/393
gitlab.com/libtiff/libtiff/-/merge_requests/287
gitlab.com/libtiff/libtiff/-/merge_requests/306
gitlab.com/libtiff/libtiff/-/merge_requests/310
gitlab.com/libtiff/libtiff/-/merge_requests/311
gitlab.com/libtiff/libtiff/-/merge_requests/314
security.archlinux.org/AVG-2658
security.archlinux.org/CVE-2022-0561
security.archlinux.org/CVE-2022-0562
security.archlinux.org/CVE-2022-0865
security.archlinux.org/CVE-2022-0891
security.archlinux.org/CVE-2022-0907
security.archlinux.org/CVE-2022-0908
security.archlinux.org/CVE-2022-0909
security.archlinux.org/CVE-2022-0924
security.archlinux.org/CVE-2022-22844
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P
0.006 Low
EPSS
Percentile
78.8%