CVE-2022-2869: Out-of-bounds Read

August 17, 2022 (updated November 7, 2023)

libtiff’s tiffcrop tool has a uint32_t underflow which leads to out-of-bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.

References

bugzilla.redhat.com/show_bug.cgi?id=2118869
nvd.nist.gov/vuln/detail/CVE-2022-2869

Code Behaviors & Features

Detect and mitigate CVE-2022-2869 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →