---
title: "CVE-2022-1622\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-1622?format=md
keywords: index, follow
---

# CVE-2022-1622

Publication date 11 May 2022

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.5 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2022-1622?format=md#impact-score)

Toggle side navigation

## Description

LibTIFF master branch has an out-of-bounds read in LZWDecode in
libtiff/tif\_lzw.c:619, allowing attackers to cause a denial-of-service via
a crafted tiff file. For users that compile libtiff from sources, the fix
is available with commit b4e79bfa.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2022-1622?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| tiff | 22.04 LTS jammy | Not affected |
| 21.10 impish | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2022-1622?format=md#patch-details)

## Notes

---

### [ccdm94](https://launchpad.net/~ccdm94)

according to the issue in the libtiff git (410), this only affects
version 4.3.0 onwards, more specifically, versions that include
commit 3079627e. Further investigation has confirmed that versions
below 4.3.0 seem to be not affected, as the reproducer does not
work, and there are no SEGV errors. Impish and jammy, which
include version 4.3.0, also do not seem to be affected, as results
from running the POCs with their versions are different than the
ones obtained when the specific commit mentioned in the 410 issue
by the issue reporter is used with the same POC files (commit
b51bb157). For this reason, and because jammy and earlier do not
include code from commit 3079627e, these releases will be marked
as not vulnerable.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| tiff | * Upstream:   [b4e79bf](https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.5 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Local |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | Required |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.5 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1622)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-1622)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-1622)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-1622)

### Other references

* <https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a>
* <https://gitlab.com/libtiff/libtiff/-/issues/410>
* <https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json>
* <https://www.cve.org/CVERecord?id=CVE-2022-1622>