PT-2022-6800 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-10-19 · Updated 2024-06-15 · CVE-2022-41838

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.4.2

Description A code execution issue exists in the DDS scanline parsing functionality, which can lead to a heap buffer overflow when a specially-crafted .dds file is provided. This can allow an attacker to trigger the issue, potentially leading to access to confidential data, disruption of data integrity, and denial of service.

Recommendations For version 2.4.4.2, consider disabling the DDS scanline parsing functionality until a patch is available to prevent exploitation. Restrict access to the vulnerable functionality to minimize the risk of exploitation. Avoid using specially-crafted .dds files in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2023-04794

CVE-2022-41838

DLA-3382-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12477-1

Affected Products

Astra Linux

Openimageio

References · 38

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1634 · Exploit
• https://osv.dev/vulnerability/CVE-2022-41838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41838 · Security Note
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04794 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12477-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41838 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41838 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41838 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory