Lucene search

PRIOn knowledge basePRION:CVE-2022-43602

HistoryDec 22, 2022 - 10:15 p.m.

Heap overflow

2022-12-2222:15:00

PRIOn knowledge base

www.prio-n.com

heap overflow

openimageio

code execution

vulnerabilities

buffer overflow

imageoutput object

malicious input

nvd

8.3 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.8%

JSON

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the ymax variable is set to 0xFFFF and m_spec.format is TypeDesc::UINT8

CPENameOperatorVersion
debian_linuxeq11.0
openimageioeq2.4.4.2

CPE	Name	Operator	Version
	debian_linux	eq	11.0
	openimageio	eq	2.4.4.2

References

security.gentoo.org/glsa/202305-33

talosintelligence.com/vulnerability_reports/TALOS-2022-1656

www.debian.org/security/2023/dsa-5384