QID 354431

Out-of-bounds read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.
For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. (
( CVE-2022-1056) a heap buffer overflow flaw was found in libtiffs' tiffinfo.c in tiffreadrawdatastriped() function.
This flaw allows an attacker to pass a crafted tiff file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service. (
( CVE-2022-1354) a stack buffer overflow flaw was found in libtiffs' tiffcp.c in main() function.
This flaw allows an attacker to pass a crafted tiff file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service. (
( CVE-2022-1355) an out-of-bounds read vulnerability was found in libtiff's lzwdecode() function in libtiff/tif_lzw.c.
This flaw allows an attacker to perform a denial-of-service attack via a crafted tiff file, leading to the application crashing. (
( CVE-2022-1622) an out-of-bounds read vulnerability was found in libtiff's lzwdecode() function in libtiff/tif_lzw.c.
( CVE-2022-1623) a flaw was found in libtiff's tiffcrop tool that has a uint32_t underflow, which leads to an out-of-bounds read and write in the extractcontigsamples8bits routine.
This flaw allows an attacker who supplies a crafted file to tiffcrop to trick a user into opening the crafted file with tiffcrop, causing a crash or potential further exploitations. (
( CVE-2022-2869)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.