PT-2022-7113 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-10-19 · Updated 2023-08-07 · CVE-2022-41649

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.3.19.0

Description A heap out of bounds read issue exists in the handling of IPTC data while parsing TIFF images. This can be triggered by a specially-crafted TIFF file, causing a read of adjacent heap memory and potentially leaking sensitive process information. An attacker can exploit this by providing a malicious file.

Recommendations For OpenImageIO version 2.3.19.0, consider avoiding the use of TIFF images or restricting access to the image parsing functionality until a patch is available. As a temporary workaround, refrain from processing untrusted TIFF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-07632

CVE-2022-41649

DLA-3518-1

DSA-5384-1

Affected Products

Astra Linux

Openimageio

References · 22

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1631 · Exploit
• https://ubuntu.com/security/CVE-2022-41649 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41649 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41649 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41649 · Security Note
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41649 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3518-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07632 · Security Note
• https://osv.dev/vulnerability/DSA-5384-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41649 · Vendor Advisory
• https://github.com/OpenImageIO/oiio/commit/884dfd6b7c1fd6130390853b5074ddeb48f2f19b · Note