CVE-2022-1056

Published: Mar 28, 2022Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.

Affected (2)

Products: Libtiff: Libtiff · Netapp: Active Iq Unified Manager

Libtiff

1 product

Libtiff

Netapp

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libtiff Libtiff	Version 4.3.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (10)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1056.json

Source: cve@gitlab.com

Third Party Advisory

https://gitlab.com/libtiff/libtiff/-/issues/391

Source: cve@gitlab.com

ExploitIssue TrackingThird Party Advisory

https://gitlab.com/libtiff/libtiff/-/merge_requests/307

Source: cve@gitlab.com

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/202210-10

Source: cve@gitlab.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221228-0008/

Source: cve@gitlab.com

Third Party Advisory

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1056.json