CVE-2022-3597 is an out-of-bounds write vulnerability in LibTIFF 4.4.0, specifically within the _TIFFmemcpy function, which can be triggered by a crafted TIFF file. This flaw primarily affects products utilizing LibTIFF, including various Debian distributions and NetApp Active IQ Unified Manager, and could lead to a denial-of-service condition. Rated with a CVSS score of 6.5 (Medium), the vulnerability requires user interaction (UI:R) via a malicious file, but has low attack complexity (AC:L) and no authentication required (PR:N). The primary impact is high availability loss (A:H), with no confidentiality or integrity impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.4.0CPE matchmatch criteria | cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection tools/tiffcrop.c:6826 allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources the fix is available with commit 236b7191.
Oct 11, 2022libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix
Mar 21, 2022