PT-2023-18722 · Unknown+1 · Openimageio+1

Lilith >_>

·

Publicado

2023-03-30

·

Atualizado

2024-06-15

·

CVE-2023-22845

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1
Description An out-of-bounds read issue exists in the TGAInput::decode pixel() functionality. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this issue.
Recommendations For OpenImageIO version 2.4.7.1, consider avoiding the use of the TGAInput::decode pixel() function until a patch is available. As a temporary workaround, restrict the handling of targa files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2023-22845
MGASA-2023-0151
OPENSUSE-SU-2024:12693-1

Produtos afetados

Debian
Openimageio