The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
Weakness
The product uses or accesses a resource that has not been initialized.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libtiff | Libtiff | 4.0.3-35 (including) | 4.0.3-35 (including) |
| Tiff | Ubuntu | bionic | * |
| Tiff | Ubuntu | esm-infra-legacy/trusty | * |
| Tiff | Ubuntu | esm-infra/bionic | * |
| Tiff | Ubuntu | esm-infra/focal | * |
| Tiff | Ubuntu | esm-infra/xenial | * |
| Tiff | Ubuntu | focal | * |
| Tiff | Ubuntu | impish | * |
| Tiff | Ubuntu | trusty | * |
| Tiff | Ubuntu | trusty/esm | * |
| Tiff | Ubuntu | upstream | * |