CVE-2022-3570: Buffer Overflow
Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tiffto a version that resolves this vulnerability.Fixed in 4.1.0+git191117-2~deb10u8Fixed in 4.2.0-1+deb11u4Fixed in 4.2.0-1+deb11u5Fixed in 4.5.0-6+deb12u1Fixed in 4.5.1+git230720-3
Event History
Frequently Asked Questions
What is CVE-2022-3570?
CVE-2022-3570 is a vulnerability in the libtiff library that allows an attacker to trigger heap buffer overflows via a crafted TIFF image file, potentially leading to application crashes or other impacts.
How severe is CVE-2022-3570?
CVE-2022-3570 has a severity rating of 5.5, which is considered high.
Which versions of the libtiff library are affected?
Versions 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, and 4.5.1+git230720-1 of the libtiff library are affected.
How can I fix CVE-2022-3570?
To fix CVE-2022-3570, update the libtiff library to a version that is not affected, such as 4.1.0+git191117-2~deb10u8, 4.2.0-1+deb11u4, 4.5.0-6, or 4.5.1+git230720-1.
Are there any references for CVE-2022-3570?
Yes, you can find references for CVE-2022-3570 at the following URLs: [Reference 1](https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff), [Reference 2](https://gitlab.com/libtiff/libtiff/-/issues/381), [Reference 3](https://gitlab.com/libtiff/libtiff/-/issues/386).