Denial-of-Service Vulnerability in libtiff 4.3.0
Summary
CVE-2022-0865: Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. Affects tiff across 2 version ranges.
< 4.3.0-r0
< d21dcc67d0d3f4686ee989a085ad2bea9c58259d
Fixed in 4.3.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtiff is an open-source library for reading and writing TIFF image files. It is widely used in various applications and operating systems. However, a vulnerability has been discovered in version 4.3.0 of libtiff that can lead to a denial-of-service attack. This vulnerability allows attackers to cause the tiffcp utility to crash when processing a specially crafted TIFF file.
Vulnerability Detail
The vulnerability, identified as CVE-2022-0865, arises from an assertion that can be reached by manipulating the contents of a TIFF file. When the tiffcp utility encounters a crafted file, it fails to handle it properly, resulting in a crash. This vulnerability can be exploited by an attacker to disrupt the functionality of systems that use libtiff, potentially leading to a denial-of-service condition. The severity of this vulnerability is rated as moderate with a CVSS score of 6.5.
How To Fix
Minimum fixed version
4.3.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade tiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update libtiff to the fixed version as soon as possible to ensure the security and stability of systems that rely on libtiff.
Conclusion
In conclusion, libtiff version 4.3.0 is vulnerable to a denial-of-service attack due to a reachable assertion in the tiffcp utility. To mitigate this vulnerability, it is crucial to update libtiff to version 4.3.0-r0 or later. No known workaround is available, and updating to the fixed version is the recommended solution. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for tiff →
FAQ
libtiff is an open-source library for reading and writing TIFF image files. It is commonly used in various applications and operating systems.
This vulnerability can be exploited by attackers to cause a denial-of-service condition, potentially disrupting the functionality of systems that use libtiff.
To fix this vulnerability, update libtiff to version 4.3.0-r0 or later. If you have compiled libtiff from sources, apply commit 5e180045 from the official libtiff Git repository.
No, there is no known workaround for this vulnerability. Updating libtiff to the fixed version is the recommended solution.
The severity of this vulnerability is rated as moderate with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for tiff.
