{"affected":[{"product":"libtiff","source":"CNA: redhat","vendor":"n/a","versions":[{"status":"affected","version":"Not-Known"}]}],"cveId":"CVE-2022-1354","cwes":["CWE-125"],"description":"A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.","epss":{"date":"2026-11-02","percentile":0.46736,"score":0.00562},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793643709926,"publishedAt":1661904000000,"references":[{"source":"CNA: redhat","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074404"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.com/libtiff/libtiff/-/issues/319"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798"},{"source":"CNA: redhat","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2022-1354"},{"source":"CNA: redhat","tags":[],"url":"https://security.netapp.com/advisory/ntap-20221014-0007/"},{"source":"CNA: redhat","tags":["vendor-advisory"],"url":"https://security.gentoo.org/glsa/202210-10"},{"source":"CNA: redhat","tags":["mailing-list"],"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html"},{"source":"CNA: redhat","tags":["vendor-advisory"],"url":"https://www.debian.org/security/2023/dsa-5333"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074404"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://gitlab.com/libtiff/libtiff/-/issues/319"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2022-1354"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://security.netapp.com/advisory/ntap-20221014-0007/"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://security.gentoo.org/glsa/202210-10"},{"source":"ADP: CVE","tags":["mailing-list","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://www.debian.org/security/2023/dsa-5333"}],"remediation":[],"revision":"86631a1c0a8a43aef249bb2453265cec2bf1bc3a21403fb4755e1b300c0c8c3c","sources":[{"modifiedAt":1793643709926,"name":"CNA: redhat","retrievedAt":1793646506691,"url":"https://www.cve.org/CVERecord?id=CVE-2022-1354"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646507797,"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1354"}],"ssvc":{"assessedAt":1791493890764,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2022-1354","updatedAt":1793646507797}