High severity7.7NVD Advisory· Published Oct 21, 2022· Updated Jun 17, 2026

CVE-2022-3570

Description

Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

LibTIFF/Libtiff3 versions
cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:libtiff:libtiff:*:*:*:*:*:*:*:*range: >=3.9.0,<=4.4.0
- (no CPE)range: <4.4.0
- (no CPE)range: >=3.9.0, <=4.4.0
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
osv-coords37 versions
pkg:rpm/almalinux/libtiff pkg:rpm/almalinux/libtiff-devel pkg:rpm/almalinux/libtiff-tools pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%20Micro%205.2 pkg:rpm/opensuse/tiff&distro=openSUSE%20Leap%20Micro%205.3 pkg:rpm/opensuse/tiff&distro=openSUSE%20Tumbleweed pkg:rpm/suse/tiff&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/tiff&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Micro%205.3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP3 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/tiff&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Proxy%204.1 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1 pkg:rpm/suse/tiff&distro=SUSE%20Manager%20Server%204.1
< 4.4.0-7.el9+ 36 more
- (no CPE)range: < 4.4.0-7.el9
- (no CPE)range: < 4.4.0-7.el9
- (no CPE)range: < 4.4.0-7.el9
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.5.0-1.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-44.62.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-44.62.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-44.62.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1
- (no CPE)range: < 4.0.9-150000.45.22.1

Patches

Vulnerability mechanics

References

gitlab.com/libtiff/libtiff/-/commit/bd94a9b383d8755a27b5a1bc27660b8ad10b094cnvdPatch
gitlab.com/libtiff/libtiff/-/issues/381nvdExploitIssue TrackingPatchThird Party Advisory
gitlab.com/libtiff/libtiff/-/issues/386nvdExploitIssue TrackingPatchThird Party Advisory
gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3570.jsonnvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2023/01/msg00018.htmlnvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20230203-0002/nvdThird Party Advisory
www.debian.org/security/2023/dsa-5333nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000