CVE-2022-3598: Out-of-bounds Write

October 21, 2022 (updated March 31, 2023)

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json
gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff
gitlab.com/libtiff/libtiff/-/issues/435
nvd.nist.gov/vuln/detail/CVE-2022-3598

Code Behaviors & Features

Detect and mitigate CVE-2022-3598 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →