CVE-2022-0909

2022-03-1100:00:00

GitLab

www.cve.org

cve-2022-0909

tiffcrop

denial-of-service

crafted tiff file

libtiff

fix available

commit f8d0f9aa

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

59.9%

JSON

Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.

CNA Affected

[
  {
    "vendor": "libtiff",
    "product": "libtiff",
    "versions": [
      {
        "version": "=4.3.0",
        "status": "affected"
      }
    ]
  }
]