CVE-2023-24472

2023-03-3016:15:07

Google

osv.dev

denial of service

openimageio

fitsoutput

cve-2023-24472

imageoutput object

malicious input

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.3%

JSON

A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.

CPENameOperatorVersion
oiioeqRelease-1.6.2de
oiioeqspi-spcomp2-release-43.0
oiioeqspiArn3.5.50.0
oiioeqRelease-1.1.0-beta1
oiioeqRelease-1.9.2de
oiioeqspi-Arn3.4.73.6
oiioeqRelease-1.1.0-beta3
oiioeqspi-Arn3.5.25.0
oiioeqspi-Arn3.6.18.0
oiioeqspi-spcomp2-release-41.0

Name	Operator	Version
oiio	eq	Release-1.6.2de
oiio	eq	spi-spcomp2-release-43.0
oiio	eq	spiArn3.5.50.0
oiio	eq	Release-1.1.0-beta1
oiio	eq	Release-1.9.2de
oiio	eq	spi-Arn3.4.73.6
oiio	eq	Release-1.1.0-beta3
oiio	eq	spi-Arn3.5.25.0
oiio	eq	spi-Arn3.6.18.0
oiio	eq	spi-spcomp2-release-41.0