What’s Vulnerable › Vulnerabilities

CVE-2022-0561

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-11 · updated 2026-06-17
• Weakness: CWE-476

Description

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

Affected products

• Debian Linux: 9.0, 10.0, 11.0
• Fedoraproject Fedora: 35
• libtiff: from 3.9.0 through 4.3.0
• NetApp ONTAP Select Deploy administration utility: all versions
• Red Hat Enterprise Linux: 8.0

References

• https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json
• https://gitlab.com/libtiff/libtiff/-/issues/362
• https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM/
• https://security.gentoo.org/glsa/202210-10
• https://security.netapp.com/advisory/ntap-20220318-0001/
• https://www.debian.org/security/2022/dsa-5108
• https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json
• https://gitlab.com/libtiff/libtiff/-/issues/362
• https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html

Get alerted when CVE-2022-0561 or the next vulnerability affects your stack