VulnerabilityModified

CVE-2022-3627

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file.

MEDIUM 6.5EPSS 1.09%

Does this matter?

Lower severity and a low EPSS score (1.09%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 1.09% probability · 64th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: libtiff/libtiff · netapp/active iq unified manager · debian/debian linux
Source: cve@gitlab.com

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3627.jsonThird Party Advisory, VDB Entry
https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047Patch
https://gitlab.com/libtiff/libtiff/-/issues/411Exploit, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20230110-0001/Third Party Advisory
https://www.debian.org/security/2023/dsa-5333Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3627.jsonThird Party Advisory, VDB Entry
https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047Patch
https://gitlab.com/libtiff/libtiff/-/issues/411Exploit, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20230110-0001/Third Party Advisory
https://www.debian.org/security/2023/dsa-5333Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.