PT-2022-6814 · Unknown+1 · Openimageio+1

Lilith >_>

·

Published

2022-11-14

·

Updated

2023-05-30

·

CVE-2022-43600

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.4.2
Description Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO. A specially crafted ImageOutput Object can lead to a heap buffer overflow. This issue arises when the xmax variable is set to 0xFFFF and m spec.format is TypeDesc::UINT16. An attacker can provide malicious input to trigger these vulnerabilities, potentially allowing remote access to confidential data, disruption of data integrity, and denial of service.
Recommendations For OpenImageIO version 2.4.4.2, consider disabling the IFFOutput::close() function until a patch is available to prevent exploitation. Restrict access to the IFFOutput component to minimize the risk of exploitation. Avoid using the xmax variable with a value of 0xFFFF and m spec.format set to TypeDesc::UINT16 in the affected ImageOutput Object until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Weakness Enumeration

Related Identifiers

BDU:2023-04809
CVE-2022-43600
DLA-3382-1
DSA-5384-1
MGASA-2023-0151

Affected Products

Astra Linux
Openimageio