MediumFix available
tiff — security advisory
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
- Products
- tiff
- Affected versions
- Not specified
- Fixed versions
- 4.3.0-r0, 4.3.0-r1
- CVEs
- CVE-2022-0561
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:08 UTC · Revision 1
Source evidence
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
osv:ALPINE-CVE-2022-0561
tiff
Fixed versions: 4.3.0-r0
tiff
Fixed versions: 4.3.0-r0
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
tiff
Fixed versions: 4.3.0-r1
Complete source record
{
"id": "b79675c049d2090ae7dca5d0be488de4aa3c510d31e7a2d22ace8a756e9d260e",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2022-0561",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2022-0561",
"summary": "Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.",
"evidence": "osv:ALPINE-CVE-2022-0561",
"products": [
{
"name": {
"value": "tiff",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tiff",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.3.0-r1",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2022-0561",
"aliases": [
"ALPINE-CVE-2022-0561"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r0"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r0"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-r1"
}
]
}
],
"package": {
"name": "tiff",
"purl": "pkg:apk/alpine/tiff?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-0561.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-15T07:17:54.143551442Z",
"provider": "osv",
"upstream": [
"CVE-2022-0561"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2022-0561"
]
},
"related_cves": [
{
"value": "CVE-2022-0561",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 321604,
"published_at": "2022-02-11T18:15:11.033+00:00"
}