PT-2022-7116 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2022-10-20 · Updated 2024-06-15 · CVE-2022-41794

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.3.19.0

Description A heap-based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code. This issue can be triggered by a specially-crafted PSD file, potentially leading to arbitrary code execution. An attacker can exploit this vulnerability by providing a malicious file.

Recommendations For OpenImageIO version 2.3.19.0, consider avoiding the use of PSD files until a patch is available. As a temporary workaround, restrict access to the PSD thumbnail resource parsing code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2023-07635

CVE-2022-41794

DLA-3518-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12477-1

Affected Products

Astra Linux

Openimageio

References · 41

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1626 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41794 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41794 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-41794 · Security Note
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41794 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12477-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3518-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07635 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory