JLSEC-2025-261

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-261.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-261.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2025-261

Upstream

CVE-2022-0562

Published

2025-11-25T22:18:43.603Z

Modified

2026-07-25T18:24:02.503090005Z

Severity

4.3 (Medium) CVSS_V2 - AV:N/AC:M/Au:N/C:N/I:N/A:P CVSS Calculator
5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in...

Details

Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0562",
            "database_specific": {
                "status": "Modified"
            },
            "id": "CVE-2022-0562",
            "modified": "2026-06-17T04:20:50.930Z",
            "imported": "2026-07-17T20:52:56.292Z",
            "published": "2022-02-11T18:15:11.083Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-0562"
        }
    ]
}

References

Affected packages

Julia / Libtiff_jll

Package

Name: Libtiff_jll
Purl: pkg:julia/Libtiff_jll?uuid=89763e89-9b03-5906-acba-b20f662cd828

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.4.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-261.json"