CVE-2022-0561: Debian Linux

Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only
• Libtiff Libtiff: from 3.9.0, up to and including 4.3.0
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only

Published 2022-02-11. Last modified 2026-06-17.