CVE-2022-2953

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8.

• CWE-125

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2953.jsonExploit, Issue Tracking, Patch, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3Patch
• https://gitlab.com/libtiff/libtiff/-/issues/414Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221014-0008/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5333Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2953.jsonExploit, Issue Tracking, Patch, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3Patch
• https://gitlab.com/libtiff/libtiff/-/issues/414Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221014-0008/Third Party Advisory
• https://www.debian.org/security/2023/dsa-5333Third Party Advisory

Published

Aug 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
• CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
• CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Pri…5.3
• CVE-2022-29527Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a worl…7
• CVE-2022-29528An issue was discovered in MISP before 2.4.158. PHAR deseria…9.8
• CVE-2022-29529An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29530An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29531An issue was discovered in MISP before 2.4.158. There is sto…5.4
• CVE-2022-29532An issue was discovered in MISP before 2.4.158. There is XSS…4.8
• CVE-2022-29533An issue was discovered in MISP before 2.4.158. There is XSS…6.1
• CVE-2022-29534An issue was discovered in MISP before 2.4.158. In UsersCont…7.5
• CVE-2022-29535Zoho ManageEngine OPManager through 125588 allows SQL Inject…9.8