Vulnerability Description
A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtiff | Libtiff | < 4.4.0 |
| Fedoraproject | Fedora | 34 |
| Redhat | Enterprise Linux | 7.0 |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2022-1355Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2074415ExploitIssue TrackingThird Party Advisory
- https://gitlab.com/libtiff/libtiff/-/issues/400ExploitIssue TrackingPatch
- https://gitlab.com/libtiff/libtiff/-/merge_requests/323Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-10Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221014-0007/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5333Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-1355Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2074415ExploitIssue TrackingThird Party Advisory
- https://gitlab.com/libtiff/libtiff/-/issues/400ExploitIssue TrackingPatch
- https://gitlab.com/libtiff/libtiff/-/merge_requests/323Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-10Third Party Advisory
- https://security.netapp.com/advisory/ntap-20221014-0007/Third Party Advisory
FAQ
What is CVE-2022-1355?
CVE-2022-1355 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, ...
How severe is CVE-2022-1355?
CVE-2022-1355 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-1355?
Check the references section above for vendor advisories and patch information. Affected products include: Libtiff Libtiff, Fedoraproject Fedora, Redhat Enterprise Linux, Netapp Ontap Select Deploy Administration Utility, Debian Debian Linux.