LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "libtiff/tif_lzw.c", "function": "LZWPreDecode" }, "deprecated": false, "digest": { "length": 1508.0, "function_hash": "99610717102855534426409033808273071332" }, "id": "CVE-2022-1622-9b318011", "source": "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "libtiff/tif_lzw.c" }, "deprecated": false, "digest": { "line_hashes": [ "297304205499719229723862582735391797184", "15433957502830867365031511810630214268", "212246105566467323765702300287524938539", "57201324518598256529912329638284093607", "924326278261024855579029760551291294", "198651057446999146972310869395586213217", "259002140627107494332398747423618063596", "324067406375592853659512906454570304710", "248811850483569804806380334611492579744", "95910564819394607255018754234021125078", "291220921187703762238360898628621394452", "3648640367411898551406150155254360071", "129680571501969712790997894156773833199", "164715822644765660797502729876167356518", "252580422337327598812012930021645676916", "151754513886909563869075708452516409737" ], "threshold": 0.9 }, "id": "CVE-2022-1622-d7cd34c9", "source": "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "libtiff/tif_lzw.c", "function": "LZWDecode" }, "deprecated": false, "digest": { "length": 5343.0, "function_hash": "63749783208390883576011996837381271528" }, "id": "CVE-2022-1622-dd5d9e10", "source": "https://gitlab.com/libtiff/libtiff@b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a" } ] }