PT-2022-6804 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-10-19 · Updated 2024-06-15 · CVE-2022-41999

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenImageIO versions 2.3.19.0 through 2.4.4.2

Description A denial of service issue exists in the DDS native tile reading functionality. This can be triggered by a specially-crafted .dds file, allowing an attacker to cause a denial of service. The vulnerability is related to pointer dereference errors and can be exploited by providing a malicious file.

Recommendations For versions 2.3.19.0 and 2.4.4.2, consider disabling the DDS native tile reading functionality as a temporary workaround until a patch is available. Restrict access to handling .dds files to minimize the risk of exploitation. Avoid using the vulnerable functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-04798

CVE-2022-41999

DLA-3382-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12477-1

Affected Products

Astra Linux

Openimageio

References · 39

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1635 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41999 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41999 · Vendor Advisory
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12477-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41999 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41999 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04798 · Security Note
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41999 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory