Description
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libtiff libtiff
3079627ea0dee150e6a208cec8381de611bb842baffected
References
- https://gitlab.com/libtiff/libtiff/-/issues/410 ↗
- https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a ↗
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json ↗
- https://security.netapp.com/advisory/ntap-20220616-0005/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/ ↗
- https://support.apple.com/kb/HT213443 ↗
- https://support.apple.com/kb/HT213444 ↗
- https://support.apple.com/kb/HT213446 ↗
- https://support.apple.com/kb/HT213488 ↗
- https://support.apple.com/kb/HT213486 ↗
- https://support.apple.com/kb/HT213487 ↗
- http://seclists.org/fulldisclosure/2022/Oct/41 ↗
- http://seclists.org/fulldisclosure/2022/Oct/28 ↗
- http://seclists.org/fulldisclosure/2022/Oct/39 ↗