PT-2023-19629 · Unknown+1 · Openimageio+1

Lilith >_> · Published 2023-03-30 · Updated 2024-06-15 · CVE-2023-24473

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1

Description An information disclosure issue exists in the TGAInput::read tga2 header functionality. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this issue.

Recommendations For version 2.4.7.1, consider avoiding the use of the TGAInput::read tga2 header functionality until a patch is available. As a temporary workaround, restrict the handling of targa files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-24473

MGASA-2023-0151

OPENSUSE-SU-2024:12693-1

Affected Products

Debian

Openimageio

References · 26

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1707 · Exploit
• https://cve.org/CVERecord?id=CVE-2023-24473 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12693-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24473 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/T3LET4MEPBSBJZK4EMLEBY4FUXKU5BMN · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-24473 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LK6TY36VQ3FQXMZ2VXHZGQ43VDLD67GG · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/openimageio · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24473 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24473 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-24473 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24473 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory