CVE-2022-1210 LibTIFF tiff2ps resource consumption
Attackers can cause a denial of service in LibTIFF's tiff2ps utility by tricking users into opening a malicious TIFF file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1210?
CVE-2022-1210 is a medium-severity denial of service vulnerability in Libtiff Libtiff, published on 3 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2022-1210?
It affects 2 products.
Linux distribution packages (17)
jbigkit SUSE:Linux Enterprise Micro 5.2 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Micro 5.3 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Micro 5.4 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Micro 5.5 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Micro 5.5 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Real Time 15 SP4 | All versions | 2.1-150000.3.5.1 |
jbigkit SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.0-14.3.1 |
jbigkit SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.0-14.3.1 |
jbigkit SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.0-14.3.1 |
jbigkit SUSE:Linux Micro 6.0 | All versions | 2.1-4.1 |
jbigkit SUSE:Linux Micro 6.1 | All versions | 2.1-slfo.1.1_2.1 |
jbigkit openSUSE:Leap 15.4 | All versions | 2.1-150000.3.5.1 |
jbigkit openSUSE:Leap 15.5 | All versions | 2.1-150000.3.5.1 |
jbigkit openSUSE:Leap Micro 5.3 | All versions | 2.1-150000.3.5.1 |
jbigkit openSUSE:Leap Micro 5.4 | All versions | 2.1-150000.3.5.1 |
jbigkit openSUSE:Tumbleweed | All versions | 2.1-5.1 |
Products include Libtiff Libtiff, Netapp Ontap Select Deploy Administration Utility.
How do I fix CVE-2022-1210?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-1210 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1210 exists.
Other vulnerabilities in Libtiff Libtiff
Sources
Also known as AZL-9302, DEBIAN-CVE-2022-1210, ECHO-8e20-aed6-33d5, GHSA-3h6x-gjf3-36gg, JLSEC-2025-268, ROOT-OS-DEBIAN-12-CVE-2022-1210 and 7 more.