CVE-2022-3970
A vulnerability was found in LibTIFF.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.28% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- libtiff/libtiff · netapp/active iq unified manager · debian/debian linux · apple/safari · apple/ipados · apple/iphone os · apple/macos
- Source
- cna@vuldb.com
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137Exploit, Issue Tracking, Third Party Advisory
- https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3bePatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing List, Third Party Advisory
- https://oss-fuzz.com/download?testcase_id=5738253143900160Product
- https://security.netapp.com/advisory/ntap-20221215-0009/Third Party Advisory
- https://support.apple.com/kb/HT213841Release Notes, Third Party Advisory
- https://support.apple.com/kb/HT213843Release Notes, Third Party Advisory
- https://vuldb.com/?id.213549Third Party Advisory, VDB Entry
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137Exploit, Issue Tracking, Third Party Advisory
- https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3bePatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlMailing List, Third Party Advisory
- https://oss-fuzz.com/download?testcase_id=5738253143900160Product
- https://security.netapp.com/advisory/ntap-20221215-0009/Third Party Advisory
- https://support.apple.com/kb/HT213841Release Notes, Third Party Advisory
- https://support.apple.com/kb/HT213843Release Notes, Third Party Advisory
- https://vuldb.com/?id.213549Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.