CVE-2022-3970
LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
Se encontró una vulnerabilidad en LibTIFF. Ha sido clasificada como crítica. Esto afecta a la función TIFFReadRGBATileExt del archivo libtiff/tif_getimage.c. La manipulación conduce a un desbordamiento de enteros. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El nombre del parche es 227500897dfb07fb7d27f7aa570050e62617e3be. Se recomienda aplicar un parche para solucionar este problema. A esta vulnerabilidad se le asignó el identificador VDB-213549.
An integer overflow flaw was found in LibTIFF. This issue exists in the TIFFReadRGBATileExt function of the libtiff/tif_getimage.c file, and may lead to a buffer overflow.
It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. This issue was only fixed in Ubuntu 14.04 ESM. It was discovered that LibTIFF was incorrectly accessing a data structure when processing data with the tiffcrop tool, which could lead to a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2022-11-13 CVE Reserved
- 2022-11-13 CVE Published
- 2025-04-15 CVE Updated
- 2025-04-15 First Exploit
- 2025-06-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-189: Numeric Errors
- CWE-680: Integer Overflow to Buffer Overflow
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html | Mailing List |
|
https://oss-fuzz.com/download?testcase_id=5738253143900160 | Product | |
https://security.netapp.com/advisory/ntap-20221215-0009 | Third Party Advisory |
|
https://support.apple.com/kb/HT213841 | Release Notes |
|
https://support.apple.com/kb/HT213843 | Release Notes |
|
https://vuldb.com/?id.213549 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137 | 2025-04-15 |
URL | Date | SRC |
---|---|---|
https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be | 2023-11-17 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2022-3970 | 2023-05-16 | |
https://bugzilla.redhat.com/show_bug.cgi?id=2148918 | 2023-05-16 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Libtiff Search vendor "Libtiff" | Libtiff Search vendor "Libtiff" for product "Libtiff" | < 4.5.0 Search vendor "Libtiff" for product "Libtiff" and version " < 4.5.0" | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | < 16.5.1 Search vendor "Apple" for product "Safari" and version " < 16.5.1" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Ipados Search vendor "Apple" for product "Ipados" | < 16.6 Search vendor "Apple" for product "Ipados" and version " < 16.6" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 16.6 Search vendor "Apple" for product "Iphone Os" and version " < 16.6" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Macos Search vendor "Apple" for product "Macos" | < 13.5 Search vendor "Apple" for product "Macos" and version " < 13.5" | - |
Affected
|