CVE-2022-43600

2022-12-2222:15:16

CWE-122

[email protected]

web.nvd.nist.gov

code execution

openimageio

heap buffer overflow

imageoutput

malicious input

vulnerabilities

typedesc

uint16

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.013

Percentile

86.3%

JSON

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the xmax variable is set to 0xFFFF and m_spec.format is TypeDesc::UINT16

Affected configurations

Nvd

Node

openimageioopenimageioMatch2.4.4.2

Node

debiandebian_linuxMatch11.0

VendorProductVersionCPE
openimageioopenimageio2.4.4.2cpe:2.3:a:openimageio:openimageio:2.4.4.2:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openimageio	openimageio	2.4.4.2	cpe:2.3:a:openimageio:openimageio:2.4.4.2:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*