CVE-2022-43600

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-43592

CVE-2022-43592 affects OpenImageIO (notably OpenImageIO v2.4.4.2). The issue is an information disclosure in the DPXOutput::close() path: a specially crafted ImageOutput object can leak heap data. Available connected advisories confirm the root cause in DPXOutput::close() and classify the impact ...

CVE-2022-41977

CVE-2022-41977 affects OpenImageIO v2.3.19.0 with an out-of-bounds read when processing TIFF string fields, enabling information disclosure via a crafted file. Debian/Gentoo advisories recommend upgrading to fixed OpenImageIO releases (e.g., Debian 2.2.10.1+dfsg-1+deb11u1 or newer) to mitigate.

CVE-2022-43601

CVE-2022-43601 affects OpenImageIO OpenImageIO v2.4.4.2: multiple code-execution/heap-overflow risks in IFFOutput::close() when ymax is 0xFFFF with m_spec.format = TypeDesc::UINT16. Connected advisories confirm OpenImageIO vulnerabilities in this release and note remediation via upgrading to newe...

CVE-2022-41838

CVE-2022-41838: OpenImageIO v2.4.4.2 DDS scanline parsing contains a heap buffer overflow when processing a specially crafted .dds, enabling code execution as described in multiple advisories. Connected sources indicate remediation via upgrading to OpenImageIO 2.4.6.0 or newer (e.g., Gentoo/Magei...

CVE-2022-41649

CVE-2022-41649 is a heap out-of-bounds read in OpenImageIO’s handling of IPTC data when parsing TIFF images in v2.3.19.0, enabling potential information disclosure via a malicious TIFF file. Connected advisories confirm affected OpenImageIO versions and recommend upgrading; GLSA-202305-33 suggest...

CVE-2022-43598

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This...

CVE-2022-38143

A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43603

A denial of service vulnerability exists in the ZfileOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-43602

OpenImageIO vulnerabilities exist in IFFOutput::close() that can trigger heap buffer overflows when ymax is 0xFFFF and m_spec.format is TypeDesc::UINT8/UINT16, affecting OpenImageIO v2.4.4.2 (CVE-2022-43599/43600/43601 and related CVEs). Public advisories (Debian DSA-5384, GLSA-202305-33, Mageia ...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-43600

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43603

OpenImageIO has a denial-of-service vulnerability CVE-2022-43603 in ZfileOutput::close() for OpenImageIO v2.4.4.2 where processing a malicious ImageOutput can crash the application. Public advisories (Gentoo GLSA, Fedora advisory) indicate the fix is to upgrade to OpenImageIO 2.4.6.x (e.g., 2.4.6...

CVE-2022-41684

A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-41838

A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-43592

An information disclosure vulnerability exists in the DPXOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability...

CVE-2022-41988

An information disclosure vulnerability exists in the OpenImageIO::decodeiptciim functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability...