CVE-2023-24473

2023-03-3016:15:07

Google

osv.dev

tgainput::read_tga2_header

tga file

sensitive information disclosure

malicious file

security vulnerability

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability.

CPENameOperatorVersion
oiioeqRelease-1.6.2de
oiioeqspi-spcomp2-release-43.0
oiioeqspiArn3.5.50.0
oiioeqRelease-1.1.0-beta1
oiioeqRelease-1.9.2de
oiioeqspi-Arn3.4.73.6
oiioeqRelease-1.1.0-beta3
oiioeqspi-Arn3.5.25.0
oiioeqspi-Arn3.6.18.0
oiioeqspi-spcomp2-release-41.0

Name	Operator	Version
oiio	eq	Release-1.6.2de
oiio	eq	spi-spcomp2-release-43.0
oiio	eq	spiArn3.5.50.0
oiio	eq	Release-1.1.0-beta1
oiio	eq	Release-1.9.2de
oiio	eq	spi-Arn3.4.73.6
oiio	eq	Release-1.1.0-beta3
oiio	eq	spi-Arn3.5.25.0
oiio	eq	spi-Arn3.6.18.0
oiio	eq	spi-spcomp2-release-41.0