PT-2023-19629 · Unknown+1 · Openimageio+1

Lilith >_>

·

Publicado

2023-03-30

·

Atualizado

2024-06-15

·

CVE-2023-24473

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1
Description An information disclosure issue exists in the TGAInput::read tga2 header functionality. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this issue.
Recommendations For version 2.4.7.1, consider avoiding the use of the TGAInput::read tga2 header functionality until a patch is available. As a temporary workaround, restrict the handling of targa files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2023-24473
MGASA-2023-0151
OPENSUSE-SU-2024:12693-1

Produtos afetados

Debian
Openimageio