CVE-2022-0865

Published: Mar 10, 2022Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.

Affected (5)

Products: Libtiff: Libtiff · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Libtiff: Libtiff · Debian: Debian Linux · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager

1 product

1 product

1 product

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Version 4.3.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Fedoraproject Fedora	Version 36

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (16)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json

Source: cve@gitlab.com

Third Party AdvisoryVDB Entry

https://gitlab.com/libtiff/libtiff/-/issues/385

Source: cve@gitlab.com

ExploitIssue TrackingPatchThird Party Advisory

https://gitlab.com/libtiff/libtiff/-/merge_requests/306

Source: cve@gitlab.com

ExploitIssue TrackingPatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/

Source: cve@gitlab.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/

Source: cve@gitlab.com

https://security.gentoo.org/glsa/202210-10

Source: cve@gitlab.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221228-0008/

Source: cve@gitlab.com

Third Party Advisory

https://www.debian.org/security/2022/dsa-5108

Source: cve@gitlab.com

Third Party Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json