CVE-2022-48281: debian debian_linux Out-of-bounds Write
CVSS: 5.5v3.1MediumModified
AliasesALPINE-CVE-2022-48281MGASA-2023-0038SUSE-SU-2023:0199-1SUSE-SU-2023:0342-1RHSA-2023:3827UBUNTU-CVE-2022-48281DEBIAN-CVE-2022-48281DLA-3297-1openSUSE-SU-2024:12643-1
Published 23-01-2023Last modified 03-04-2025
Vulnerability summary
CVE-2022-48281 is a medium (CVSS 5.5) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 23-01-2023PublishedVulnerability first disclosed.
- 03-04-2025Last modifiedVulnerability information updated.
Description
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 5.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 19-09-2026
19-09-202619-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse29 products
- tiff&distro=SUSE Enterprise Storage 6< 4.0.9-150000.45.25.1
- tiff&distro=SUSE Enterprise Storage 7< 4.0.9-150000.45.25.1
- tiff&distro=SUSE Enterprise Storage 7.1< 4.0.9-150000.45.25.1
- tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 4.0.9-150000.45.25.1
- tiff&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 4.0.9-150000.45.25.1
Redhat6 products
- libtiff< 0:4.0.9-28.el8_8
- libtiff-debuginfo< 0:4.0.9-28.el8_8
- libtiff-debugsource< 0:4.0.9-28.el8_8
- libtiff-devel< 0:4.0.9-28.el8_8
- libtiff-tools< 0:4.0.9-28.el8_8
Opensuse4 products
- tiff&distro=openSUSE Leap 15.4< 4.0.9-150000.45.25.1
- tiff&distro=openSUSE Leap Micro 5.2< 4.0.9-150000.45.25.1
- tiff&distro=openSUSE Leap Micro 5.3< 4.0.9-150000.45.25.1
- tiff&distro=openSUSE Tumbleweed< 4.5.0-2.1
Debian2 products
- tiff< 4.1.0+git191117-2~deb10u6 | < 4.5.0-4
- debian_linuxEOL10.0 | 11.0
Alpine1 product
- tiff< 4.4.0-r2 | < 4.5.0-r3
Libtiff1 product
- libtiff≤ 4.5.0
Mageia1 product
- libtiff< 4.2.0-1.13.mga8
Ubuntu1 product
- tiff< 4.0.3-7ubuntu0.11+esm6 | < 4.0.6-1ubuntu0.8+esm9 | < 4.0.9-5ubuntu0.10+esm2 | < 4.1.0+git191117-2ubuntu0.20.04.9 | < 4.3.0-6ubuntu0.5
8 vendors · 45 products
References
25 links- gitlab.com/libtiff/libtiff/-/commit/d1b6b9c1b3cae2d9e37754506c1ad8f4f7b646b5PatchThird Party Advisory
- security.gentoo.org/glsa/202305-31Vendor Advisory
