high8.1
CVE-2022-43597
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2.
Impact
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openimageio | Openimageio | Version 2.4.4.2 |
| Debian | Debian Linux | Version 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://security.gentoo.org/glsa/202305-33
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655
- https://www.debian.org/security/2023/dsa-5384
- https://security.gentoo.org/glsa/202305-33
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655
- https://www.debian.org/security/2023/dsa-5384