CVE-2022-0562: 
NixOS vulnerability analysis and mitigation

CVE-2022-0562 is a vulnerability discovered in libtiff versions 4.0 to 4.3.0, where a null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c could lead to Denial of Service via crafted TIFF file (NVD, Debian Security). The vulnerability was discovered in February 2022, and a fix was made available through commit 561599c for users compiling libtiff from sources.

The vulnerability occurs in the TIFFReadDirectory() function within tif_dirread.c when a null pointer is passed as an argument to the memcpy() function. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability is classified as a NULL Pointer Dereference (CWE-476) (NVD, NetApp Security).

When successfully exploited, this vulnerability can result in a Denial of Service (DoS) condition when processing crafted TIFF files (NetApp Security, Gentoo Security).

The vulnerability has been fixed in libtiff version 4.4.0 and later. For users compiling from source, the fix is available in commit 561599c. Various Linux distributions have released security updates to address this vulnerability, including Debian (version 4.2.0-1+deb11u1), Fedora (version 4.3.0-4.fc35), and Gentoo (version 4.4.0) (Debian Security, Fedora Update, Gentoo Security).