CVE-2022-1354: debian debian_linux Out-of-bounds Read

Vulnerability summary

CVE-2022-1354 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 31-08-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.