PT-2022-6817 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-11-14 · Updated 2024-06-15 · CVE-2022-43603

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.4.2

Description A denial of service issue exists in the ZfileOutput::close() functionality of OpenImageIO. This can be triggered by a specially crafted ImageOutput Object, allowing an attacker to cause a denial of service by providing a malicious file. The vulnerability is related to pointer dereference errors and can be exploited remotely.

Recommendations For OpenImageIO version 2.4.4.2, consider disabling the ZfileOutput::close() functionality as a temporary workaround until a patch is available. Restrict access to the ZfileOutput component to minimize the risk of exploitation. Avoid using specially crafted ImageOutput Objects that can trigger this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-04812

CVE-2022-43603

DLA-3382-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12589-1

Affected Products

Astra Linux

Openimageio

References · 35

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1657 · Exploit
• https://bdu.fstec.ru/vul/2023-04812 · Security Note
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43603 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43603 · Security Note
• https://osv.dev/vulnerability/DSA-5384-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-43603 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-43603 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-43603 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory