CVE-2022-1354

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-1354
A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2022-1354 Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2074404 Exploit Issue Tracking Patch Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 Patch
https://gitlab.com/libtiff/libtiff/-/issues/319 Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202210-10 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221014-0007/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5333 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-1354 Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2074404 Exploit Issue Tracking Patch Third Party Advisory
https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 Patch
https://gitlab.com/libtiff/libtiff/-/issues/319 Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202210-10 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221014-0007/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5333 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

21 Nov 2024, 06:40

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2022-1354 - Issue Tracking, Third Party Advisory () https://access.redhat.com/security/cve/CVE-2022-1354 - Issue Tracking, Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2074404 - Exploit, Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2074404 - Exploit, Issue Tracking, Patch, Third Party Advisory
References () https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 - Patch () https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 - Patch
References () https://gitlab.com/libtiff/libtiff/-/issues/319 - Exploit, Issue Tracking, Patch, Third Party Advisory () https://gitlab.com/libtiff/libtiff/-/issues/319 - Exploit, Issue Tracking, Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202210-10 - Third Party Advisory () https://security.gentoo.org/glsa/202210-10 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20221014-0007/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20221014-0007/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5333 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5333 - Third Party Advisory

23 Feb 2023, 15:50

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References
  • (DEBIAN) https://www.debian.org/security/2023/dsa-5333 - Third Party Advisory
  • (MLIST) https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - Mailing List, Third Party Advisory

07 Nov 2022, 19:10

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/202210-10 - (GENTOO) https://security.gentoo.org/glsa/202210-10 - Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20221014-0007/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20221014-0007/ - Third Party Advisory
CPE cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

31 Oct 2022, 04:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202210-10 -

14 Oct 2022, 13:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20221014-0007/ -
CWE CWE-787 CWE-125
CPE cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:* cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

07 Sep 2022, 15:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-787
References (MISC) https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 - (MISC) https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 - Patch, Third Party Advisory
References (MISC) https://gitlab.com/libtiff/libtiff/-/issues/319 - (MISC) https://gitlab.com/libtiff/libtiff/-/issues/319 - Exploit, Issue Tracking, Patch, Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2074404 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2074404 - Exploit, Issue Tracking, Patch, Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2022-1354 - (MISC) https://access.redhat.com/security/cve/CVE-2022-1354 - Issue Tracking, Third Party Advisory
CPE cpe:2.3:a:libtiff:libtiff:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

31 Aug 2022, 16:53

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-31 16:15

Updated : 2024-11-21 06:40

NVD link : CVE-2022-1354

Mitre link : CVE-2022-1354

CVE.ORG link : CVE-2022-1354

JSON object : View

Products Affected

fedoraproject

  • fedora

redhat

  • enterprise_linux

netapp

  • ontap_select_deploy_administration_utility

libtiff

  • libtiff

debian

  • debian_linux
CWE
CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write