Medium severity6.1NVD Advisory· Published Mar 10, 2022· Updated Jun 17, 2026

CVE-2022-0891

Description

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

LibTIFF/Libtiff3 versions
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*range: >=3.9.0,<=4.3.0
- (no CPE)range: <4.3.0
- (no CPE)range: >=3.9.0, <=4.3.0
NetApp/Active Iq Unified Manager
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
osv-coords34 versions
pkg:rpm/almalinux/libtiff pkg:rpm/almalinux/libtiff-devel pkg:rpm/almalinux/libtiff-tools pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/tiff&distro=openSUSE%20Tumbleweed pkg:rpm/suse/tiff&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/tiff&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Proxy%204.1 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Server%204.1
< 4.0.9-23.el8+ 33 more
- (no CPE)range: < 4.0.9-23.el8
- (no CPE)range: < 4.0.9-23.el8
- (no CPE)range: < 4.0.9-23.el8
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.3.0-2.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-44.48.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-44.48.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-44.48.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1
- (no CPE)range: < 4.0.9-150000.45.8.1

Patches

Vulnerability mechanics

References

gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7cnvdPatchThird Party Advisory
gitlab.com/libtiff/libtiff/-/issues/380nvdExploitIssue TrackingPatchThird Party Advisory
gitlab.com/libtiff/libtiff/-/issues/382nvdExploitIssue TrackingPatchThird Party Advisory
gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.jsonnvdThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/202210-10nvdThird Party Advisory
security.netapp.com/advisory/ntap-20221228-0008/nvdThird Party Advisory
www.debian.org/security/2022/dsa-5108nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000