The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0
    allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could
    result into application crash, potential information disclosure or any other context-dependent impact
    (CVE-2022-0891)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in
    tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF
    file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c
    in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users
    that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted
    tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3690-1 advisory.

    - CVE-2022-2519: Fixed a double free in rotateImage() (bsc#1202968).
    - CVE-2022-2520: Fixed a assertion failure in rotateImage() (bsc#1202973).
    - CVE-2022-2521: Fixed invalid free in TIFFClose() (bsc#1202971).
    - CVE-2022-2867: Fixed out of bounds read and write in tiffcrop.c (bsc#1202466).
    - CVE-2022-2868: Fixed out of bounds read in reverseSamples16bits() (bsc#1202467).
    - CVE-2022-2869: Fixed out of bounds read and write in extractContigSamples8bits() (bsc#1202468).
    - CVE-2022-34526: Fixed stack overflow in the _TIFFVGetField function of Tiffsplit (bsc#1202026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3679-1 advisory.

    - CVE-2022-2519: Fixed a double free in rotateImage() (bsc#1202968).
    - CVE-2022-2520: Fixed a assertion failure in rotateImage() (bsc#1202973).
    - CVE-2022-2521: Fixed invalid free in TIFFClose() (bsc#1202971).
    - CVE-2022-2867: Fixed out of bounds read and write in tiffcrop.c (bsc#1202466).
    - CVE-2022-2868: Fixed out of bounds read in reverseSamples16bits() (bsc#1202467).
    - CVE-2022-2869: Fixed out of bounds read and write in extractContigSamples8bits() (bsc#1202468).
    - CVE-2022-34526: Fixed stack overflow in the _TIFFVGetField function of Tiffsplit (bsc#1202026).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1814 advisory.

    A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy() function     within the TIFFReadDirectory() in tif_dirread.c. This flaw allows an attacker to exploit this     vulnerability via a crafted TIFF file, causing a crash and leading to a denial of service. (CVE-2022-0562)

    A flaw was found in libtiff-4.0.3-35.amzn2.0.1 as packaged on Amazon Linux 2. When processing a malicious     TIFF file, an invalid range may be passed as an argument to the memset() function within     TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault. Actors can use     this issue to potentially cause a Denial of Service condition. (CVE-2022-34266)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424616	Alpine: libtiffxx, multiple tiff packages: security update to 4.3.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424616	Alpine: libtiffxx, multiple tiff packages: security update to 4.3.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
166418	SUSE SLED15: libtiff-devel / libtiff-devel-32bit / libtiff5 / libtiff5-32bit / etc (SUSE-SU-2022:3690-1)	Nessus	SuSE Local Security Checks	medium
166371	SUSE SLES12 Security Update : tiff (SUSE-SU-2022:3679-1)	Nessus	SuSE Local Security Checks	medium
163236	Amazon Linux 2 : libtiff (ALAS-2022-1814)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2022-34266

medium

Tenable Plugins

high

high

medium

medium

medium