CVE catalog

CVE-2022-3970

tiff affected and fixed versions

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Nov 8, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.34% · Oct 27, 2026

Projects and upstream resources

[tiff][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	tiff	`4.7.0-3+deb13u3`	Fixed	[CVE-2022-3970]
Debiantrixie	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debiantrixie	tiff	`4.7.0-3+deb13u3`	Fixed	[CVE-2022-3970]
Debiansid	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debiansid	tiff	`4.7.2-1`	Fixed	[CVE-2022-3970]
Debianforky	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debianforky	tiff	`4.7.2-1`	Fixed	[CVE-2022-3970]
Debianbookworm-security	tiff	`4.5.0-6+deb12u4`	Fixed	[CVE-2022-3970]
Debianbookworm	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debianbookworm	tiff	`4.5.0-6+deb12u4`	Fixed	[CVE-2022-3970]

Showing 10 fix observations. All 66 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debianbookworm	tiff	`4.5.0-6+deb12u4`	Fixed	[CVE-2022-3970]
Debianbookworm-security	tiff	`4.5.0-6+deb12u4`	Fixed	[CVE-2022-3970]
Debianforky	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debianforky	tiff	`4.7.2-1`	Fixed	[CVE-2022-3970]
Debiansid	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debiansid	tiff	`4.7.2-1`	Fixed	[CVE-2022-3970]
Debiantrixie	tiff	`4.4.0-6`	FixedDistribution-reported fixed boundary	[CVE-2022-3970]
Debiantrixie	tiff	`4.7.0-3+deb13u3`	Fixed	[CVE-2022-3970]
Debiantrixie-security	tiff	`4.7.0-3+deb13u3`	Fixed	[CVE-2022-3970]
Ubuntu18.04	tiff	`4.0.8-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.8-6`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-4ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu18.04	tiff	`4.0.9-5ubuntu0.9`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.0.10+git191003-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu20.04	tiff	`4.1.0+git191117-2ubuntu0.20.04.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-3build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-6`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-6ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-6ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntu22.04	tiff	`4.3.0-6ubuntu0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC[USN-5743-2]Apr 22, 2026, 10:29:48 AM UTC
Ubuntupro	tiff	`4.0.3-12.3ubuntu2`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.5-1`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.1`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.2`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.3`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.4`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.5`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.6`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.7`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm1`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm2`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm3`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm4`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm6`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm7`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC
Ubuntupro	tiff	`4.0.6-1ubuntu0.8+esm8`	UnknownSource applicability is not established	[USN-5743-1]Jun 25, 2026, 1:31:36 PM UTC[UBUNTU-CVE-2022-3970]Apr 22, 2026, 1:29:37 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "tiff",
      "status": "fixed",
      "release": "sid",
      "version": "4.7.2-1"
    },
    {
      "name": "tiff",
      "status": "fixed",
      "release": "forky",
      "version": "4.7.2-1"
    },
    {
      "name": "tiff",
      "status": "fixed",
      "release": "trixie",
      "version": "4.7.0-3+deb13u3"
    },
    {
      "name": "tiff",
      "status": "fixed",
      "release": "trixie-security",
      "version": "4.7.0-3+deb13u3"
    },
    {
      "name": "tiff",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.5.0-6+deb12u4"
    },
    {
      "name": "tiff",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "4.5.0-6+deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1024737,
      "name": "tiff",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.0-6"
    },
    {
      "bug": 1024737,
      "name": "tiff",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.0-6"
    },
    {
      "bug": 1024737,
      "name": "tiff",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.0-6"
    },
    {
      "bug": 1024737,
      "name": "tiff",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.0-6"
    }
  ],
  "distribution_packages": [
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.6-1ubuntu0.8+esm8"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.0.3-12.3ubuntu2",
        "4.0.5-1",
        "4.0.6-1",
        "4.0.6-1ubuntu0.1",
        "4.0.6-1ubuntu0.2",
        "4.0.6-1ubuntu0.3",
        "4.0.6-1ubuntu0.4",
        "4.0.6-1ubuntu0.5",
        "4.0.6-1ubuntu0.6",
        "4.0.6-1ubuntu0.7",
        "4.0.6-1ubuntu0.8",
        "4.0.6-1ubuntu0.8+esm1",
        "4.0.6-1ubuntu0.8+esm2",
        "4.0.6-1ubuntu0.8+esm3",
        "4.0.6-1ubuntu0.8+esm4",
        "4.0.6-1ubuntu0.8+esm6",
        "4.0.6-1ubuntu0.8+esm7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5743-1",
      "fixed_version": "4.0.6-1ubuntu0.8+esm8",
      "provider_source": "pypi",
      "provider_record_id": "USN-5743-1",
      "provider_updated_at": "2026-06-25T13:31:36.101547934Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.6-1ubuntu0.8+esm8"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.0.3-12.3ubuntu2",
        "4.0.5-1",
        "4.0.6-1",
        "4.0.6-1ubuntu0.1",
        "4.0.6-1ubuntu0.2",
        "4.0.6-1ubuntu0.3",
        "4.0.6-1ubuntu0.4",
        "4.0.6-1ubuntu0.5",
        "4.0.6-1ubuntu0.6",
        "4.0.6-1ubuntu0.7",
        "4.0.6-1ubuntu0.8",
        "4.0.6-1ubuntu0.8+esm1",
        "4.0.6-1ubuntu0.8+esm2",
        "4.0.6-1ubuntu0.8+esm3",
        "4.0.6-1ubuntu0.8+esm4",
        "4.0.6-1ubuntu0.8+esm6",
        "4.0.6-1ubuntu0.8+esm7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3970",
      "fixed_version": "4.0.6-1ubuntu0.8+esm8",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3970",
      "provider_updated_at": "2026-04-22T13:29:37.507887Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.9-5ubuntu0.9"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.0.8-5",
        "4.0.8-6",
        "4.0.9-1",
        "4.0.9-2",
        "4.0.9-3",
        "4.0.9-4",
        "4.0.9-4ubuntu1",
        "4.0.9-5",
        "4.0.9-5ubuntu0.1",
        "4.0.9-5ubuntu0.2",
        "4.0.9-5ubuntu0.3",
        "4.0.9-5ubuntu0.4",
        "4.0.9-5ubuntu0.5",
        "4.0.9-5ubuntu0.6",
        "4.0.9-5ubuntu0.7",
        "4.0.9-5ubuntu0.8"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3970",
      "fixed_version": "4.0.9-5ubuntu0.9",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3970",
      "provider_updated_at": "2026-04-22T13:29:37.507887Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0+git191117-2ubuntu0.20.04.7"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "4.0.10+git191003-1",
        "4.1.0+git191117-1",
        "4.1.0+git191117-2",
        "4.1.0+git191117-2build1",
        "4.1.0+git191117-2ubuntu0.20.04.1",
        "4.1.0+git191117-2ubuntu0.20.04.2",
        "4.1.0+git191117-2ubuntu0.20.04.3",
        "4.1.0+git191117-2ubuntu0.20.04.4",
        "4.1.0+git191117-2ubuntu0.20.04.5",
        "4.1.0+git191117-2ubuntu0.20.04.6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3970",
      "fixed_version": "4.1.0+git191117-2ubuntu0.20.04.7",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3970",
      "provider_updated_at": "2026-04-22T13:29:37.507887Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0-6ubuntu0.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "4.3.0-1",
        "4.3.0-2",
        "4.3.0-3",
        "4.3.0-3build1",
        "4.3.0-4",
        "4.3.0-5",
        "4.3.0-6",
        "4.3.0-6ubuntu0.1",
        "4.3.0-6ubuntu0.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-3970",
      "fixed_version": "4.3.0-6ubuntu0.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-3970",
      "provider_updated_at": "2026-04-22T13:29:37.507887Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.9-5ubuntu0.9"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.0.8-5",
        "4.0.8-6",
        "4.0.9-1",
        "4.0.9-2",
        "4.0.9-3",
        "4.0.9-4",
        "4.0.9-4ubuntu1",
        "4.0.9-5",
        "4.0.9-5ubuntu0.1",
        "4.0.9-5ubuntu0.2",
        "4.0.9-5ubuntu0.3",
        "4.0.9-5ubuntu0.4",
        "4.0.9-5ubuntu0.5",
        "4.0.9-5ubuntu0.6",
        "4.0.9-5ubuntu0.7",
        "4.0.9-5ubuntu0.8"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5743-2",
      "fixed_version": "4.0.9-5ubuntu0.9",
      "provider_source": "pypi",
      "provider_record_id": "USN-5743-2",
      "provider_updated_at": "2026-04-22T10:29:48.080007Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0+git191117-2ubuntu0.20.04.7"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "4.0.10+git191003-1",
        "4.1.0+git191117-1",
        "4.1.0+git191117-2",
        "4.1.0+git191117-2build1",
        "4.1.0+git191117-2ubuntu0.20.04.1",
        "4.1.0+git191117-2ubuntu0.20.04.2",
        "4.1.0+git191117-2ubuntu0.20.04.3",
        "4.1.0+git191117-2ubuntu0.20.04.4",
        "4.1.0+git191117-2ubuntu0.20.04.5",
        "4.1.0+git191117-2ubuntu0.20.04.6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5743-2",
      "fixed_version": "4.1.0+git191117-2ubuntu0.20.04.7",
      "provider_source": "pypi",
      "provider_record_id": "USN-5743-2",
      "provider_updated_at": "2026-04-22T10:29:48.080007Z",
      "applicability_unknown": true
    },
    {
      "name": "tiff",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0-6ubuntu0.3"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "4.3.0-1",
        "4.3.0-2",
        "4.3.0-3",
        "4.3.0-3build1",
        "4.3.0-4",
        "4.3.0-5",
        "4.3.0-6",
        "4.3.0-6ubuntu0.1",
        "4.3.0-6ubuntu0.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5743-2",
      "fixed_version": "4.3.0-6ubuntu0.3",
      "provider_source": "pypi",
      "provider_record_id": "USN-5743-2",
      "provider_updated_at": "2026-04-22T10:29:48.080007Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1024737]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libtiff5-dev]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiff6]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiff-dev]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiff-doc]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · all · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · all · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · all · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · all · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiff-opengl]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiff-tools]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
[libtiffxx6]Unknown
Source package: [tiff]
Details (4)
- 4.5.0-6+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm
- 4.5.0-6+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 4.4.0-6
  dsa · tiff · debian · bookworm

Observed: Oct 28, 2026, 6:14:35 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]