PT-2022-6806 · Unknown+1 · Openimageio+1
Lilith >_>
·
Published
2022-11-14
·
Updated
2024-06-15
·
CVE-2022-43592
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenImageIO version 2.4.4.2
Description
An information disclosure issue exists in the DPXOutput::close() functionality. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this issue, potentially allowing a remote attacker to access confidential data using a specially created file.
Recommendations
For OpenImageIO version 2.4.4.2, consider disabling the DPXOutput::close() functionality until a patch is available to prevent potential information disclosure. Restrict access to the DPXOutput component to minimize the risk of exploitation. Avoid using specially crafted ImageOutput Objects in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Openimageio