CVE-2022-43602

2022-12-2222:15:16

Google

osv.dev

openimageio project

code execution

heap buffer overflow

imageoutput object

malicious input vulnerability

typedesc::uint8

0xffff

iffoutput::close()

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.8%

JSON

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the ymax variable is set to 0xFFFF and m_spec.format is TypeDesc::UINT8

CPENameOperatorVersion
oiioeqRelease-1.6.2de
oiioeqspi-spcomp2-release-43.0
oiioeqspiArn3.5.50.0
oiioeqRelease-1.1.0-beta1
oiioeqRelease-1.9.2de
oiioeqspi-Arn3.4.73.6
oiioeqRelease-1.1.0-beta3
oiioeqspi-Arn3.5.25.0
oiioeqspi-Arn3.6.18.0
oiioeqspi-spcomp2-release-41.0

Name	Operator	Version
oiio	eq	Release-1.6.2de
oiio	eq	spi-spcomp2-release-43.0
oiio	eq	spiArn3.5.50.0
oiio	eq	Release-1.1.0-beta1
oiio	eq	Release-1.9.2de
oiio	eq	spi-Arn3.4.73.6
oiio	eq	Release-1.1.0-beta3
oiio	eq	spi-Arn3.5.25.0
oiio	eq	spi-Arn3.6.18.0
oiio	eq	spi-spcomp2-release-41.0