Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2022-3627: libtiff may crash from crafted TIFF file
CVE-2022-3627 · published 4 years ago
Summary
The libtiff library used in products such as NetApp Active IQ Unified Manager and Debian Linux can be forced to write outside its memory bounds when it processes a specially crafted TIFF image. This can cause the application to stop working, leading to a denial-of-service condition. Upgrade libtiff to the latest version or apply the available patch from the libtiff project to resolve the issue.
What to do
- Update debian tiff to version 4.4.0-5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | libtiff | libtiff |
<= 4.4.0 cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:* |
| – | netapp | active_iq_unified_manager |
All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| – | debian | debian_linux |
10.0 11.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Debian:12 | debian | tiff |
< 4.4.0-5 Fix: upgrade to 4.4.0-5
|
Original advisory text
CVE-2022-3627 does not affect BellSoft software
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
References
- https://docs.bell-sw.com/security/cves/CVE-2022-3627 Vendor Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3627.json URL
- https://gitlab.com/libtiff/libtiff/-/issues/411 Third Party Advisory
- https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c84... Patch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230110-0001/ Vendor Advisory
- https://www.debian.org/security/2023/dsa-5333 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3627.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3627 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-3627 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-787Out-of-bounds Write
Timeline
Published21 Oct 2022
Updated4 Nov 2026
First seen6 Sep 2026
Track software like this
Free during beta