CVE-2022-1355 is a stack buffer overflow vulnerability in Libtiffs' tiffcp tool, specifically within the main() function of tiffcp.c. This flaw affects products from Debian, Fedora Project, Libtiff, NetApp, and Red Hat. An attacker can trigger this vulnerability by providing a specially crafted TIFF file, leading to memory corruption and a denial of service. Rated as Medium severity with a CVSS score of 6.1, the attack requires user interaction (UI:R) and local access (AV:L), but has low attack complexity (AC:L). The primary impact is a high availability loss (A:H), with no confidentiality or integrity impact (C:N, I:L). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, indicating a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.4.0CPE matchmatch criteria | cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.