| Vulnerability Name: | CVE-2022-1354 (CCN-235001) | ||||||||||||||||||
| Assigned: | 2022-04-12 | ||||||||||||||||||
| Published: | 2022-04-12 | ||||||||||||||||||
| Updated: | 2023-02-23 | ||||||||||||||||||
| Summary: | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. | ||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 5.0 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
5.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
5.0 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
| ||||||||||||||||||
| CVSS v2 Severity: | 4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
| ||||||||||||||||||
| Vulnerability Type: | CWE-125 | ||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-1354 Source: secalert@redhat.com Type: Issue Tracking, Third Party Advisory secalert@redhat.com Source: CCN Type: Red Hat Bugzilla - Bug 2074404 (CVE-2022-1354) - CVE-2022-1354 libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c Source: secalert@redhat.com Type: Exploit, Issue Tracking, Patch, Third Party Advisory secalert@redhat.com Source: XF Type: UNKNOWN libtiff-cve20221354-dos(235001) Source: secalert@redhat.com Type: Patch secalert@redhat.com Source: CCN Type: libtiff GitLab heap-buffer-overflow /home/lin/libtiff/tools/tiffinfo.c:440:8 in TIFFReadRawDataStriped in branch 27f399af Source: secalert@redhat.com Type: Exploit, Issue Tracking, Patch, Third Party Advisory secalert@redhat.com Source: secalert@redhat.com Type: Mailing List, Third Party Advisory secalert@redhat.com Source: secalert@redhat.com Type: Third Party Advisory secalert@redhat.com Source: secalert@redhat.com Type: Third Party Advisory secalert@redhat.com Source: secalert@redhat.com Type: Third Party Advisory secalert@redhat.com Source: CCN Type: IBM Security Bulletin 6982383 (Watson Discovery) IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in LibTIFF Source: CCN Type: Mend Vulnerability Database CVE-2022-1354 | ||||||||||||||||||
| Vulnerable Configuration: | Configuration RedHat 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||
| Oval Definitions | |||||||||||||||||||
| |||||||||||||||||||
| BACK | |||||||||||||||||||