PT-2022-24235 · Unknown · Openimageio

Lilith >_> · Published 2022-12-22 · Updated 2024-06-15 · CVE-2022-38143

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.3.19.0

Description A heap out-of-bounds write issue exists in the way OpenImageIO processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this issue.

Recommendations For OpenImageIO version 2.3.19.0, consider avoiding the use of RLE encoded BMP images until a patch is available. As a temporary workaround, restrict the processing of bmp files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

CWE-123

Related Identifiers

CVE-2022-38143

MGASA-2023-0151

OPENSUSE-SU-2024:12477-1

Affected Products

Openimageio

References · 33

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1630 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-38143 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38143 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-38143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38143 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12477-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38143 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38143 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN · Vendor Advisory
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38143 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note