NVD Vulnerability Detail

CVE-2022-1622

Summary	LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
Publication Date	May 12, 2022, 12:15 a.m.
Registration Date	May 12, 2022, 10 a.m.
Last Update	Nov. 21, 2024, 3:41 p.m.

CVSS3.1 : MEDIUM
スコア	5.5
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	高

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:libtiff:libtiff:4.3.0:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:35:::::::*
cpe:2.3:o:fedoraproject:fedora:36:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os::::::::				16.0
cpe:2.3:o:apple:macos::::::::	11.0			11.7
cpe:2.3:o:apple:macos::::::::	12.0			12.6
cpe:2.3:o:apple:watchos::::::::				9.0
cpe:2.3:o:apple:tvos::::::::				16.0

Related information, measures and tools

No	URL	タグ
1	http://seclists.org/fulldisclosure/2022/Oct/28
2	http://seclists.org/fulldisclosure/2022/Oct/28
3	http://seclists.org/fulldisclosure/2022/Oct/39
4	http://seclists.org/fulldisclosure/2022/Oct/39
5	http://seclists.org/fulldisclosure/2022/Oct/41	Third Party Advisory
6	http://seclists.org/fulldisclosure/2022/Oct/41	Third Party Advisory
7	https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json	Third Party Advisory
8	https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json	Third Party Advisory
9	https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a	Patch Third Party Advisory
10	https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a	Patch Third Party Advisory
11	https://gitlab.com/libtiff/libtiff/-/issues/410	Exploit Third Party Advisory
12	https://gitlab.com/libtiff/libtiff/-/issues/410	Exploit Third Party Advisory
13	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/
14	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/
15	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/
16	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/
17	https://security.netapp.com/advisory/ntap-20220616-0005/	Third Party Advisory
18	https://security.netapp.com/advisory/ntap-20220616-0005/	Third Party Advisory
19	https://support.apple.com/kb/HT213443	Release Notes Third Party Advisory
20	https://support.apple.com/kb/HT213443	Release Notes Third Party Advisory
21	https://support.apple.com/kb/HT213444	Release Notes Third Party Advisory
22	https://support.apple.com/kb/HT213444	Release Notes Third Party Advisory
23	https://support.apple.com/kb/HT213446	Release Notes Third Party Advisory
24	https://support.apple.com/kb/HT213446	Release Notes Third Party Advisory
25	https://support.apple.com/kb/HT213486	Release Notes Third Party Advisory
26	https://support.apple.com/kb/HT213486	Release Notes Third Party Advisory
27	https://support.apple.com/kb/HT213487	Release Notes Third Party Advisory
28	https://support.apple.com/kb/HT213487	Release Notes Third Party Advisory
29	https://support.apple.com/kb/HT213488	Release Notes Third Party Advisory
30	https://support.apple.com/kb/HT213488	Release Notes Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

LibTIFF における境界外読み取りに関する脆弱性

Title	LibTIFF における境界外読み取りに関する脆弱性
Summary	LibTIFF には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 23, 2022, midnight
Registration Date	Aug. 22, 2023, 4:50 p.m.
Last Update	Aug. 22, 2023, 4:50 p.m.

Affected System

アップル

iOS

macOS

tvOS

watchOS

Fedora Project

Fedora

LibTIFF

NetApp

ONTAP Select Deploy administration utility

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2022-1622	https://www.cve.org/CVERecord?id=CVE-2022-1622
National Vulnerability Database (NVD)
2	CVE-2022-1622	https://nvd.nist.gov/vuln/detail/CVE-2022-1622
関連文書
3	CVE-2022-1622.json	https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT213443	https://support.apple.com/en-us/HT213443
2	HT213444	https://support.apple.com/en-us/HT213444
3	HT213446	https://support.apple.com/en-us/HT213446
4	HT213486	https://support.apple.com/en-us/HT213486
5	HT213487	https://support.apple.com/en-us/HT213487
6	HT213488	https://support.apple.com/en-us/HT213488
Apple セキュリティアップデート
7	HT213443	https://support.apple.com/ja-jp/HT213443
8	HT213444	https://support.apple.com/ja-jp/HT213444
9	HT213446	https://support.apple.com/ja-jp/HT213446
10	HT213486	https://support.apple.com/ja-jp/HT213486
11	HT213487	https://support.apple.com/ja-jp/HT213487
12	HT213488	https://support.apple.com/ja-jp/HT213488
Fedora Update Notification
13	FEDORA-2022-e9fe21d102	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/
14	FEDORA-2022-ea3ebeff3d	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/
GitLab
15	tiffcp: SEGV in LZWDecode, tif_lzw.c:619 and tif_lzw.c:624	https://gitlab.com/libtiff/libtiff/-/issues/410
16	tif_lzw.c: fix potential out-of-bounds error when trying to read in the same tile/strip after an error has occured (fixes #410)	https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a
NetApp Advisory
17	NTAP-20220616-0005	https://security.netapp.com/advisory/ntap-20220616-0005/

Change Log

No	Changed Details	Date of change
1	[2023年08月22日] 掲載	Aug. 22, 2023, 4:49 p.m.