CVE-2022-0891: Out-of-bounds Write

March 10, 2022 (updated November 7, 2023)

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out-of-bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

References

gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json
gitlab.com/libtiff/libtiff/-/issues/380
gitlab.com/libtiff/libtiff/-/issues/382
nvd.nist.gov/vuln/detail/CVE-2022-0891

Code Behaviors & Features

Detect and mitigate CVE-2022-0891 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →