CVE-2022-2867: Out-of-bounds Read

August 17, 2022 (updated November 7, 2023)

libtiff’s tiffcrop utility has a uint32_t underflow that can lead to out-of-bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.

References

bugzilla.redhat.com/show_bug.cgi?id=2118847
nvd.nist.gov/vuln/detail/CVE-2022-2867

Code Behaviors & Features

Detect and mitigate CVE-2022-2867 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →