CVE-2022-0891 MEDIUM

CVE-2022-0891

Vendor Libtiff
Product libtiff
Published March 9, 2022
Last update August 2, 2024

CVSS base score

6.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

Key dates

02Disclosure timeline

March 9, 2022 CVE published
August 2, 2024 Record updated