CVE-2022-1354

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

In order to successfully exploit this vulberability, the attacker needs to create a specially crafted TIFF file designed to exploit the buffer overflow in the TIFFReadRawDataStriped() function. The attacker must then convince or trick a user into processing the malicious TIFF file using the tiffinfo tool.

Considering the high bar of prerequisites for successful exploitation, RH ProdSec has set the Impact of this vulnerability to "Low"

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.