CVE catalog

CVE-2022-48281

tiff: CVE-2022-48281

[CVE catalog]

Severity
High · CVSS 7.7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantiffsid4.7.2-1fixed
Debiantiffforky4.7.2-1fixed
Debiantifftrixie4.7.0-3+deb13u3fixed
Debiantifftrixie-security4.7.0-3+deb13u3fixed
Debiantiffbookworm4.5.0-6+deb12u4fixed
Debiantiffbookworm-security4.5.0-6+deb12u4fixed
Ubuntutiffpro4.0.8-5vulnerable
Ubuntutiffpro4.0.8-6vulnerable
Ubuntutiffpro4.0.9-1vulnerable
Ubuntutiffpro4.0.9-2vulnerable
Ubuntutiffpro4.0.9-3vulnerable
Ubuntutiffpro4.0.9-4vulnerable
Ubuntutiffpro4.0.9-4ubuntu1vulnerable
Ubuntutiffpro4.0.9-5vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.1vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.2vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.3vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.4vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.5vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.6vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.7vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.8vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.9vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10+esm1vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10+esm2fixed
Ubuntutiff20.044.0.10+git191003-1vulnerable
Ubuntutiff20.044.1.0+git191117-1vulnerable
Ubuntutiff20.044.1.0+git191117-2vulnerable
Ubuntutiff20.044.1.0+git191117-2build1vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.1vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.2vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.3vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.4vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.5vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.6vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.7vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.8vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.9fixed
Ubuntutiff22.044.3.0-1vulnerable
Ubuntutiff22.044.3.0-2vulnerable
Ubuntutiff22.044.3.0-3vulnerable
Ubuntutiff22.044.3.0-3build1vulnerable
Ubuntutiff22.044.3.0-4vulnerable
Ubuntutiff22.044.3.0-5vulnerable
Ubuntutiff22.044.3.0-6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.1vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.2vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.3vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.4vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.5fixed
Ubuntutiffpro4.0.8-5vulnerable
Ubuntutiffpro4.0.8-6vulnerable
Ubuntutiffpro4.0.9-1vulnerable
Ubuntutiffpro4.0.9-2vulnerable
Ubuntutiffpro4.0.9-3vulnerable
Ubuntutiffpro4.0.9-4vulnerable
Ubuntutiffpro4.0.9-4ubuntu1vulnerable
Ubuntutiffpro4.0.9-5vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.1vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.2vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.3vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.4vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.5vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.6vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.7vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.8vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.9vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10+esm1vulnerable
Ubuntutiffpro4.0.9-5ubuntu0.10+esm2fixed
Ubuntutiff20.044.0.10+git191003-1vulnerable
Ubuntutiff20.044.1.0+git191117-1vulnerable
Ubuntutiff20.044.1.0+git191117-2vulnerable
Ubuntutiff20.044.1.0+git191117-2build1vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.1vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.2vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.3vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.4vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.5vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.6vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.7vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.8vulnerable
Ubuntutiff20.044.1.0+git191117-2ubuntu0.20.04.9fixed
Ubuntutiff22.044.3.0-1vulnerable
Ubuntutiff22.044.3.0-2vulnerable
Ubuntutiff22.044.3.0-3vulnerable
Ubuntutiff22.044.3.0-3build1vulnerable
Ubuntutiff22.044.3.0-4vulnerable
Ubuntutiff22.044.3.0-5vulnerable
Ubuntutiff22.044.3.0-6vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.1vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.2vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.3vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.4vulnerable
Ubuntutiff22.044.3.0-6ubuntu0.5fixed
Susetifflinux enterprise micro 5.34.0.9-150000.45.25.1fixed
Susetifflinux enterprise module for basesystem 15 sp44.0.9-150000.45.25.1fixed
Susetifflinux enterprise module for package hub 15 sp44.0.9-150000.45.25.1fixed
Susetifflinux enterprise high performance computing 15 sp1-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise high performance computing 15 sp2-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise high performance computing 15 sp3-espos4.0.9-150000.45.25.1fixed
Susetifflinux enterprise high performance computing 15 sp3-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise real time 15 sp34.0.9-150000.45.25.1fixed
Susetifflinux enterprise server 15 sp1-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise server 15 sp2-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise server 15 sp3-ltss4.0.9-150000.45.25.1fixed
Susetifflinux enterprise server for sap applications 15 sp14.0.9-150000.45.25.1fixed
Susetifflinux enterprise server for sap applications 15 sp24.0.9-150000.45.25.1fixed
Susetifflinux enterprise server for sap applications 15 sp34.0.9-150000.45.25.1fixed
Susetiffmanager proxy 4.24.0.9-150000.45.25.1fixed
Susetiffmanager retail branch server 4.24.0.9-150000.45.25.1fixed
Susetiffmanager server 4.24.0.9-150000.45.25.1fixed
Susetifflinux enterprise micro 5.24.0.9-150000.45.25.1fixed
Susetiffenterprise storage 64.0.9-150000.45.25.1fixed
Susetiffenterprise storage 74.0.9-150000.45.25.1fixed
Susetiffenterprise storage 7.14.0.9-150000.45.25.1fixed
Opensusetiffleap micro 5.24.0.9-150000.45.25.1fixed
Opensusetiffleap micro 5.34.0.9-150000.45.25.1fixed
Opensusetiffleap 15.44.0.9-150000.45.25.1fixed
Opensusetifftumbleweed4.5.0-2.1fixed
Susetiffopenstack cloud 94.0.9-44.65.1fixed
Susetiffopenstack cloud crowbar 94.0.9-44.65.1fixed
Susetifflinux enterprise server for sap applications 12 sp44.0.9-44.65.1fixed
Susetifflinux enterprise software development kit 12 sp54.0.9-44.65.1fixed
Susetifflinux enterprise server 12 sp2-bcl4.0.9-44.65.1fixed
Susetifflinux enterprise server 12 sp4-ltss4.0.9-44.65.1fixed
Susetifflinux enterprise server 12 sp54.0.9-44.65.1fixed
Susetifflinux enterprise server for sap applications 12 sp54.0.9-44.65.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantiffsourcesid4.5.0-4not yet assignedNot reported[1029653]
Debiantiffsourceforky4.5.0-4not yet assignedNot reported[1029653]
Debiantiffsourcetrixie4.5.0-4not yet assignedNot reported[1029653]
Debiantiffsourcebookworm4.5.0-4not yet assignedNot reported[1029653]
Ubuntutiffdebpro4.0.9-5ubuntu0.10+esm2Not reportedUSN-6290-1Not reported
Ubuntutiffdeb20.044.1.0+git191117-2ubuntu0.20.04.9Not reportedUSN-6290-1Not reported
Ubuntutiffdeb22.044.3.0-6ubuntu0.5Not reportedUSN-6290-1Not reported
Ubuntutiffdebpro4.0.9-5ubuntu0.10+esm2Not reportedUBUNTU-CVE-2022-48281Not reported
Ubuntutiffdeb20.044.1.0+git191117-2ubuntu0.20.04.9Not reportedUBUNTU-CVE-2022-48281Not reported
Ubuntutiffdeb22.044.3.0-6ubuntu0.5Not reportedUBUNTU-CVE-2022-48281Not reported
Susetiffrpmlinux enterprise micro 5.34.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise module for basesystem 15 sp44.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise module for package hub 15 sp44.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise high performance computing 15 sp1-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise high performance computing 15 sp2-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise high performance computing 15 sp3-espos4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise high performance computing 15 sp3-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise real time 15 sp34.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server 15 sp1-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server 15 sp2-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server 15 sp3-ltss4.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server for sap applications 15 sp14.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server for sap applications 15 sp24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise server for sap applications 15 sp34.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmmanager proxy 4.24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmmanager retail branch server 4.24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmmanager server 4.24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmlinux enterprise micro 5.24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmenterprise storage 64.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmenterprise storage 74.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Susetiffrpmenterprise storage 7.14.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Opensusetiffrpmleap micro 5.24.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Opensusetiffrpmleap micro 5.34.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Opensusetiffrpmleap 15.44.0.9-150000.45.25.1Not reportedSUSE-SU-2023:0342-1Not reported
Opensusetiffrpmtumbleweed4.5.0-2.1Not reportedOPENSUSE-SU-2024:12643-1Not reported
Susetiffrpmopenstack cloud 94.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmopenstack cloud crowbar 94.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise server for sap applications 12 sp44.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise software development kit 12 sp54.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise server 12 sp2-bcl4.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise server 12 sp4-ltss4.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise server 12 sp54.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported
Susetiffrpmlinux enterprise server for sap applications 12 sp54.0.9-44.65.1Not reportedSUSE-SU-2023:0199-1Not reported

[Debian bug #1029653]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libtiff5-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • [libtiff6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • [libtiff-dev]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • [libtiff-doc]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · all · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · all · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · all · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • [libtiff-tools]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

  • [libtiffxx6]Unknown

    Source package: [tiff]

    Details (4)
    • 4.5.0-6+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

    • 4.5.0-6+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 4.5.0-4

      dsa · tiff · debian · bookworm

[openSUSE Tumbleweed]

  • [libtiff6]Unknown

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.5.0-2.1

      Version impact unknown

      dsa · tiff · opensuse · tumbleweed

  • Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.5.0-2.1

      Version impact unknown

      dsa · tiff · opensuse · tumbleweed

  • [libtiff-devel]Unknown

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.5.0-2.1

      Version impact unknown

      dsa · tiff · opensuse · tumbleweed

  • Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 4.5.0-2.1

      Version impact unknown

      dsa · tiff · opensuse · tumbleweed

  • [tiff]Unknown

    Source package: [tiff]

    Details (1)
    • 4.7.2-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 4.5.0-2.1

      dsa · tiff · opensuse · tumbleweed

Observed:

References