CVE-2022-43600

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-41999

A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41649

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger...

CVE-2022-41999

A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41999

CVE-2022-41999 affects OpenImageIO’s DDS native tile reading in OpenImageIO v2.3.19.0 and v2.4.4.2, enabling DoS via a crafted .dds file. Connected advisories confirm this bug and point to fixes in newer OpenImageIO releases (e.g., GLSA-202305-33 recommending upgrading to OpenImageIO >= 2.4.6....

CVE-2022-43601

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43596

An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability...

CVE-2022-43592

An information disclosure vulnerability exists in the DPXOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability...

CVE-2022-43603

OpenImageIO has a denial-of-service vulnerability CVE-2022-43603 in ZfileOutput::close() for OpenImageIO v2.4.4.2 where processing a malicious ImageOutput can crash the application. Public advisories (Gentoo GLSA, Fedora advisory) indicate the fix is to upgrade to OpenImageIO 2.4.6.x (e.g., 2.4.6...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-41838

CVE-2022-41838: OpenImageIO v2.4.4.2 DDS scanline parsing contains a heap buffer overflow when processing a specially crafted .dds, enabling code execution as described in multiple advisories. Connected sources indicate remediation via upgrading to OpenImageIO 2.4.6.0 or newer (e.g., Gentoo/Magei...

CVE-2022-43596

OpenImageIO CVE-2022-43596 is an information-disclosure flaw in the IFFOutput channel interleaving of OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can leak heap data. Multiple connected advisories confirm the affected library and provide remediation guidance: Debian DSA-5384/DSA-5...

CVE-2022-41684

A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a...

CVE-2022-43599

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43601

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-41649

CVE-2022-41649 is a heap out-of-bounds read in OpenImageIO’s handling of IPTC data when parsing TIFF images in v2.3.19.0, enabling potential information disclosure via a malicious TIFF file. Connected advisories confirm affected OpenImageIO versions and recommend upgrading; GLSA-202305-33 suggest...

CVE-2022-41838

A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41988

An information disclosure vulnerability exists in the OpenImageIO::decodeiptciim functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-43593

OpenImageIO DPXOutput::close() vulnerability (CVE-2022-43593) affects OpenImageIO v2.4.4.2, where a specially crafted ImageOutput input can trigger a null pointer dereference and cause a denial of service. Public advisories confirm this CVE and recommend upgrading to a newer OpenImageIO release; ...

CVE-2022-43597

CVE-2022-43597 affects OpenImageIO (OpenImageIO v2.4.4.2) via multiple memory corruption vulnerabilities in IFFOutput alignment padding, triggered when m_spec.format is TypeDesc::UINT8. The issue can lead to arbitrary code execution. Public advisories reference affected versions and fixes; remedi...