LibTIFF 4.4.0 TIFF File libtiff/tif_unix.c _TIFFmemset out-of-bounds write
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.0 | $0-$5k | 0.00 |
A vulnerability was found in LibTIFF 4.4.0 (Image Processing Software). It has been declared as critical. This vulnerability affects the function _TIFFmemset
of the file libtiff/tif_unix.c of the component TIFF File Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
The weakness was released 10/21/2022 as 426. The advisory is available at gitlab.com. This vulnerability was named CVE-2022-3626 since 10/21/2022. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.
Applying the patch 236b7191f04c60d09ee836ae13b50f812c841047 is able to eliminate this problem. The bugfix is ready for download at gitlab.com.
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.1VulDB Meta Temp Score: 6.0
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.5
NVD Vector: 🔍
CNA Base Score: 5.5
CNA Vector (GitLab Inc.): 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Out-of-bounds writeCWE: CWE-787 / CWE-119
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Patch: 236b7191f04c60d09ee836ae13b50f812c841047
Timeline
10/21/2022 🔍10/21/2022 🔍
10/21/2022 🔍
11/19/2022 🔍
Sources
Product: libtiff.orgAdvisory: 426
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2022-3626 (🔍)
Entry
Created: 10/21/2022 21:15Updated: 11/19/2022 10:19
Changes: 10/21/2022 21:15 (45), 11/19/2022 10:19 (20)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.