CVE-2022-3626

2022-10-2100:00:00

GitLab

www.cve.org

libtiff 4.4.0

out-of-bounds write

denial-of-service

crafted tiff file

vulnerability fix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.7%

JSON

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.

CNA Affected

[
  {
    "vendor": "libtiff",
    "product": "libtiff",
    "versions": [
      {
        "version": "<=4.4.0",
        "status": "affected"
      }
    ]
  }
]