CVE-2022-1354: Out-of-bounds Write

August 31, 2022 (updated February 23, 2023)

A heap buffer overflow flaw was found in Libtiffs’ tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

References

access.redhat.com/security/cve/CVE-2022-1354
bugzilla.redhat.com/show_bug.cgi?id=2074404
gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798
gitlab.com/libtiff/libtiff/-/issues/319
nvd.nist.gov/vuln/detail/CVE-2022-1354

Code Behaviors & Features

Detect and mitigate CVE-2022-1354 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →