CVE-2022-1355: 
NixOS vulnerability analysis and mitigation

A stack buffer overflow vulnerability (CVE-2022-1355) was discovered in LibTIFF's tiffcp.c in the main() function. The vulnerability was identified in versions prior to 4.4.0 of the LibTIFF library, which provides support for manipulating Tagged Image File Format (TIFF) files (NVD, CVE).

The vulnerability exists in the main() function of tiffcp.c where a stack buffer overflow can be triggered by passing a crafted TIFF file to the tiffcp tool. The issue was discovered using AddressSanitizer which detected a stack-buffer-overflow at address 0x7ffe708226ea in the main function. The CVSS v3.1 base score for this vulnerability is 6.1 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (Gitlab Issue, NVD).

When successfully exploited, this vulnerability could lead to memory corruption and cause a crash resulting in denial of service (DoS). Additionally, it may allow for modification of data in some cases (NetApp Advisory).

The vulnerability has been fixed in LibTIFF version 4.4.0. Users are recommended to upgrade to this version or later. Various Linux distributions have also released security updates to address this vulnerability, including Red Hat Enterprise Linux, Debian, and Gentoo (Debian Advisory, Gentoo Advisory).