CVE-2022-43599 - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Back Back to CVE browser

HIGH

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Published Dec 23, 2022

8.1

HIGH

CVSS 3.1

EPSS 2.03%

Description

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8`

Affected products

Vendor OpenImageIO Project Product OpenImageIO Default
n/a
- Version
  v2.4.4.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenImageIO Project

OpenImageIO

n/a

Version	Status	Constraints
v2.4.4.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-122

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46595
Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656
ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46595		Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656		ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384		Third Party Advisory