CVE-2022-2520

Se ha encontrado un fallo en libtiff versión 4.4.0rc1. Se presenta un fallo de aserción de sysmalloc en la función rotateImage() en el archivo tiffcrop.c:8621 que puede causar la caída del programa cuando es leída una entrada diseñada

Juraj Somorovsky, Marcel Maehren, Nurullah Erinola, and Robert Merget discovered that the DTLS implementation in the JSSE subsystem of OpenJDK did not properly restrict handshake initiation requests from clients. A remote attacker could possibly use this to cause a denial of service. Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not properly validate the origin of a Soundbank. An attacker could use this to specially craft an untrusted Java application or applet that could load a Soundbank from an attacker controlled remote URL.