The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
CVE-2022-34266 - Medium Severity Vulnerability
Official repository of the OpenJPEG project
Library home page: https://github.com/uclouvain/openjpeg.git
Found in HEAD commit: 83ceb7e7e7e38a2f30d5124ce8a8e117908b1cfc
Found in base branch: master
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource.
Publish Date: 2022-07-19
URL: CVE-2022-34266
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html
Release Date: 2022-07-19
Fix Resolution: v4.4.0
Step up your Open Source Security Game with Mend here