CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-1210 – LibTIFF tiff2ps resource consumption
https://notcve.org/view.php?id=CVE-2022-1210
A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. • https://gitlab.com/libtiff/libtiff/-/issues/402 https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advisory/ntap-20220513-0005 https://vuldb.com/?id.196363 • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-1056
https://notcve.org/view.php?id=CVE-2022-1056
Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. Un error de lectura fuera de límites en tiffcrop en libtiff versión 4.3.0, permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff a partir de las fuentes, la corrección está disponible con el commit 46dc8fcd • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1056.json https://gitlab.com/libtiff/libtiff/-/issues/391 https://gitlab.com/libtiff/libtiff/-/merge_requests/307 https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advisory/ntap-20221228-0008 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0907
https://notcve.org/view.php?id=CVE-2022-0907
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2. Un Valor de Retorno no Comprobado a una Desreferencia de Puntero NULL in tiffcrop in libtiff versión 4.3.0 permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff desde las fuentes, la corrección está disponible con el commit f2b656e2 • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0907.json https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2 https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advisory • CWE-252: Unchecked Return Value •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0909 – tiff: Divide By Zero error in tiffcrop
https://notcve.org/view.php?id=CVE-2022-0909
Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa. Un error de División por cero en tiffcrop en libtiff versión 4.3.0 permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff a partir de fuentes, la corrección está disponible con el commit f8d0f9aa A floating-point exception (FPE) flaw was found in LibTIFF’s computeOutputPixelOffsets() function in tiffcrop.c file. This flaw allows an attacker with a crafted TIFF file to trigger a divide-by-zero error, causing a crash that leads to a denial of service. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0909.json https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2 https://security.gentoo.org/glsa/202210-10 https://security.netapp.com/advisory • CWE-369: Divide By Zero •
CVSS: 7.7EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0908 – tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c
https://notcve.org/view.php?id=CVE-2022-0908
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. Un puntero fuente Null pasado como argumento a la función memcpy() dentro de la función TIFFFetchNormalTag () en el archivo tif_dirread.c en libtiff versiones hasta 4.3.0, podría conllevar a una Denegación de Servicio por medio de un archivo TIFF diseñado A flaw was found in LibTIFF where a NULL source pointer passed as an argument to the memcpy() function within the TIFFFetchNormalTag() in tif_dirread.c. This flaw allows an attacker with a crafted TIFF file to cause a crash that leads to a denial of service. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0908.json https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85 https://gitlab.com/libtiff/libtiff/-/issues/383 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2 https://security.gentoo.org/glsa/202210-10 https://security.net • CWE-476: NULL Pointer Dereference •