CVE-2022-43595 - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Back Back to CVE browser

MEDIUM

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Published Dec 23, 2022

5.9

MEDIUM

CVSS 3.1

EPSS 1.27%

Description

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files.

Affected products

Vendor OpenImageIO Project Product OpenImageIO Default
n/a
- Version
  v2.4.4.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenImageIO Project

OpenImageIO

n/a

Version	Status	Constraints
v2.4.4.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46591
Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653
ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46591		Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653		ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384		Third Party Advisory