Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS libtiff may copy from an empty source
published 3 months ago
Summary
The libtiff library used on CentOS systems can call a copy operation with a missing data source, which can lead to a program crash or unstable behavior. This occurs in the TIFFFetchStripThing function when it receives a null pointer and zero length. Install the latest updates for libtiff, libtiff-devel, libtiff-static, and libtiff-tools to resolve the issue.
What to do
- Update centos libtiff to version 4.0.3-35.el7.tuxcare.els10.
- Update centos libtiff-devel to version 4.0.3-35.el7.tuxcare.els10.
- Update centos libtiff-static to version 4.0.3-35.el7.tuxcare.els10.
- Update centos libtiff-tools to version 4.0.3-35.el7.tuxcare.els10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | libtiff |
< 4.0.3-35.el7.tuxcare.els10 Fix: upgrade to 4.0.3-35.el7.tuxcare.els10
|
| TuxCare:CentOS:7 | centos | libtiff-devel |
< 4.0.3-35.el7.tuxcare.els10 Fix: upgrade to 4.0.3-35.el7.tuxcare.els10
|
| TuxCare:CentOS:7 | centos | libtiff-static |
< 4.0.3-35.el7.tuxcare.els10 Fix: upgrade to 4.0.3-35.el7.tuxcare.els10
|
| TuxCare:CentOS:7 | centos | libtiff-tools |
< 4.0.3-35.el7.tuxcare.els10 Fix: upgrade to 4.0.3-35.el7.tuxcare.els10
|
Original advisory text
libtiff: Fix of CVE-2022-0561
- CVE-2022-0561: fix TIFFFetchStripThing() calling memcpy() with a NULL source
pointer and size of zero
pointer and size of zero
References
- https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1784816759.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0561 Vendor Advisory
Timeline
Published23 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784816759 · OSV
Track software like this
Free during beta