PT-2023-18722 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2023-03-30 · Updated 2024-06-15 · CVE-2023-22845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1

Description An out-of-bounds read issue exists in the TGAInput::decode pixel() functionality. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this issue.

Recommendations For OpenImageIO version 2.4.7.1, consider avoiding the use of the TGAInput::decode pixel() function until a patch is available. As a temporary workaround, restrict the handling of targa files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-22845

MGASA-2023-0151

OPENSUSE-SU-2024:12693-1

Affected Products

Debian

Openimageio

References · 25

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1708 · Exploit
• https://ubuntu.com/security/CVE-2023-22845 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12693-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22845 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22845 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22845 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22845 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/openimageio · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22845 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22845 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory