CVE-2022-2520

2022-08-3116:15:11

CWE-617

CWE-131

[email protected]

web.nvd.nist.gov

116

libtiff

cve-2022-2520

sysmalloc assertion

program crash

crafted input

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.1%

JSON

A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.

Affected configurations

Vulners

NVD

Node

libtifflibtiffRange≤4.4.0

VendorProductVersionCPE
libtifflibtiff*cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libtiff	libtiff	*	cpe:2.3:a:libtiff:libtiff::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libtiff",
    "versions": [
      {
        "version": "libtiff 4.4.0rc1",
        "status": "affected"
      }
    ]
  }
]