search, files

• CVE-2022-0561 CVSSv3=5.5 (nixos-21.11, nixos-unstable)
• CVE-2022-0562 CVSSv3=5.5 (nixos-21.11, nixos-unstable)
• CVE-2022-22844 CVSSv3=5.5 (nixos-21.11, nixos-unstable)

CVE details

CVE-2022-0561

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

CVE-2022-0562

Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.

CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.

Scanned versions: nixos-21.11: 2128d0a; nixos-unstable: 5aaed40.

Cc @alyssais