CVE-2022-43592 - An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Back Back to CVE browser

MEDIUM

An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Published Dec 23, 2022

5.9

MEDIUM

CVSS 3.1

EPSS 1.15%

Description

An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability.

Affected products

Vendor OpenImageIO Project Product OpenImageIO Default
n/a
- Version
  v2.4.4.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenImageIO Project

OpenImageIO

n/a

Version	Status	Constraints
v2.4.4.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46588
Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1651
ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46588		Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1651		ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384		Third Party Advisory