PT-2022-6810 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-11-14 · Updated 2024-06-15 · CVE-2022-43596

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.4.2

Description The issue is related to a component of the OpenImageIO library, specifically the IFFOutput channel interleaving functionality, which is vulnerable to a buffer data reading beyond valid boundaries. This can be exploited by a remote attacker using a specially crafted file to gain access to confidential data. The vulnerability can lead to leaked heap data when a maliciously crafted ImageOutput Object is used.

Recommendations For OpenImageIO version 2.4.4.2, consider restricting the use of the IFFOutput channel interleaving functionality until a patch is available. As a temporary workaround, avoid using specially crafted ImageOutput Objects that can trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-04805

CVE-2022-43596

DLA-3382-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12589-1

Affected Products

Astra Linux

Openimageio

References · 35

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1654 · Exploit
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-43596 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-43596 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43596 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43596 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43596 · Security Note
• https://bdu.fstec.ru/vul/2023-04805 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN · Vendor Advisory