CVE-2022-0865

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.

• CWE-617

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.jsonThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/issues/385Exploit, Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/-/merge_requests/306Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/
• https://security.gentoo.org/glsa/202210-10Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5108Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.jsonThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/issues/385Exploit, Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/-/merge_requests/306Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/
• https://security.gentoo.org/glsa/202210-10Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5108Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0859McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 U…6.7
• CVE-2022-0860Improper Authorization in GitHub repository cobbler/cobbler …9.1
• CVE-2022-0861A XML Extended entity vulnerability in McAfee Enterprise ePo…3.8
• CVE-2022-0862A lack of password change protection vulnerability in a depr…5.3
• CVE-2022-0863The WP SVG Icons WordPress plugin through 3.2.3 does not pro…7.2
• CVE-2022-0864The UpdraftPlus WordPress Backup Plugin WordPress plugin bef…6.1
• CVE-2022-0866This is a concurrency issue that can result in the wrong cal…5.3
• CVE-2022-0867The Pricing Table WordPress plugin before 3.6.1 fails to pro…9.8
• CVE-2022-0868Open Redirect in GitHub repository medialize/uri.js prior to…6.1
• CVE-2022-0869Multiple Open Redirect in GitHub repository nitely/spirit pr…6.1
• CVE-2022-0870Server-Side Request Forgery (SSRF) in GitHub repository gogs…5.3
• CVE-2022-0871Missing Authorization in GitHub repository gogs/gogs prior t…9.1