Vulnerability Description
Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtiff | Libtiff | >= 3.9.0, <= 4.4.0 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3570.jsonThird Party AdvisoryVDB Entry
- https://gitlab.com/libtiff/libtiff/-/commit/bd94a9b383d8755a27b5a1bc27660b8ad10bPatch
- https://gitlab.com/libtiff/libtiff/-/issues/381ExploitIssue TrackingPatch
- https://gitlab.com/libtiff/libtiff/-/issues/386ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230203-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5333Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3570.jsonThird Party AdvisoryVDB Entry
- https://gitlab.com/libtiff/libtiff/-/commit/bd94a9b383d8755a27b5a1bc27660b8ad10bPatch
- https://gitlab.com/libtiff/libtiff/-/issues/381ExploitIssue TrackingPatch
- https://gitlab.com/libtiff/libtiff/-/issues/386ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230203-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5333Third Party Advisory
FAQ
What is CVE-2022-3570?
CVE-2022-3570 is a vulnerability with a CVSS score of 7.7 (HIGH). Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result in...
How severe is CVE-2022-3570?
CVE-2022-3570 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3570?
Check the references section above for vendor advisories and patch information. Affected products include: Libtiff Libtiff, Debian Debian Linux.