CVE-2022-43593

OpenImageIO DPXOutput::close() vulnerability (CVE-2022-43593) affects OpenImageIO v2.4.4.2, where a specially crafted ImageOutput input can trigger a null pointer dereference and cause a denial of service. Public advisories confirm this CVE and recommend upgrading to a newer OpenImageIO release; ...

CVE-2022-43597

CVE-2022-43597 affects OpenImageIO (OpenImageIO v2.4.4.2) via multiple memory corruption vulnerabilities in IFFOutput alignment padding, triggered when m_spec.format is TypeDesc::UINT8. The issue can lead to arbitrary code execution. Public advisories reference affected versions and fixes; remedi...

CVE-2022-43602

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43601

CVE-2022-43601 affects OpenImageIO OpenImageIO v2.4.4.2: multiple code-execution/heap-overflow risks in IFFOutput::close() when ymax is 0xFFFF with m_spec.format = TypeDesc::UINT16. Connected advisories confirm OpenImageIO vulnerabilities in this release and note remediation via upgrading to newe...

CVE-2022-41684

A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-43602

OpenImageIO vulnerabilities exist in IFFOutput::close() that can trigger heap buffer overflows when ymax is 0xFFFF and m_spec.format is TypeDesc::UINT8/UINT16, affecting OpenImageIO v2.4.4.2 (CVE-2022-43599/43600/43601 and related CVEs). Public advisories (Debian DSA-5384, GLSA-202305-33, Mageia ...

CVE-2022-41977

CVE-2022-41977 affects OpenImageIO v2.3.19.0 with an out-of-bounds read when processing TIFF string fields, enabling information disclosure via a crafted file. Debian/Gentoo advisories recommend upgrading to fixed OpenImageIO releases (e.g., Debian 2.2.10.1+dfsg-1+deb11u1 or newer) to mitigate.

CVE-2022-41684

CVE-2022-41684 is a heap out-of-bounds read vulnerability in OpenImageIO (master-branch-9aeece7a) when parsing the image file directory of PSD files. A specially crafted PSD can cause a read from arbitrary heap memory, leading to denial of service. Affected component: OpenImageIO PSD parsing code...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-36354

CVE-2022-36354 is a heap out-of-bounds read in OpenImageIO’s RLA format parser (master-branch 9aeece7a and v2.3.19.0). A malformed RLA file can cause an out-of-bounds read of heap metadata, potentially leaking sensitive information. Connected advisories confirm practical exposure and publicly ava...

CVE-2022-38143

A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this...

CVE-2022-41639

OpenImageIO CVE-2022-41639 is a heap-based buffer overflow in the TIFF tile decoding code, present in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially crafted TIFF file can trigger out-of-bounds memory corruption, potentially leading to arbitrary code execution. Public advisories (De...

CVE-2022-43595

CVE-2022-43595 is part of OpenImageIO OpenImageIO v2.4.4.2. It describes multiple denial-of-service vulnerabilities in the image output closing functionality, specifically leading to null pointer dereferences when handling ImageOutput and writing .fits files. The connected advisories confirm mult...

CVE-2022-43599

OpenImageIO CVE-2022-43599 affects OpenImageIO v2.4.4.2, where the IFFOutput::close() path can trigger a heap buffer overflow when xmax is 0xFFFF and m_spec.format is TypeDesc::UINT8. Connected advisories (GLSA 202305-33, Debian DSA-5384, Debian DLA-3382) describe this family of OpenImageIO vulne...

CVE-2022-41988

CVE-2022-41988 describes an information disclosure in OpenImageIO’s decode_iptc_iim() for OpenImageIO v2.3.19.0. A specially-crafted TIFF can disclose sensitive information. Connected sources corroborate this OpenImageIO information disclosure vulnerability and tie it to multiple advisories acros...

CVE-2022-43596

An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability...

CVE-2022-36354

A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensiti...

CVE-2022-43592

CVE-2022-43592 affects OpenImageIO (notably OpenImageIO v2.4.4.2). The issue is an information disclosure in the DPXOutput::close() path: a specially crafted ImageOutput object can leak heap data. Available connected advisories confirm the root cause in DPXOutput::close() and classify the impact ...