logo
DATABASE RESOURCES PRICING ABOUT US

Amazon Linux 2 : libtiff (ALAS-2022-1872)

Description

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1872 advisory. - libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. (CVE-2022-2867) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Related