CVE-2022-0891

Katalog CVE

CVSS 7.1 · High EPSS 1,5%

Kerentanan Out-of-bounds Write pada libtiff, debian linux +2 lainnya. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

Rincian

Terbit di NVD

10 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172f... patch · advisory pihak ketiga
• https://gitlab.com/libtiff/libtiff/-/issues/380 exploit · issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/libtiff/libtiff/-/issues/382 exploit · issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json advisory pihak ketiga · vdb entry
• https://security.gentoo.org/glsa/202210-10 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221228-0008/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5108 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQ...