CVE-2022-43598

2022-12-2200:00:00

ubuntu.com

cve-2022-43598

iffoutput

openimageio

memory corruption

alignment padding

imageoutput

arbitrary code execution

typedesc::uint16

unix

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

82.4%

JSON

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment
padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A
specially crafted ImageOutput Object can lead to arbitrary code execution.
An attacker can provide malicious input to trigger these
vulnerabilities.This vulnerability arises when the m_spec.format is
TypeDesc::UINT16.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchopenimageio< anyUNKNOWN
ubuntu20.04noarchopenimageio< anyUNKNOWN
ubuntu22.04noarchopenimageio< anyUNKNOWN
ubuntu24.04noarchopenimageio< anyUNKNOWN
ubuntu16.04noarchopenimageio< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	openimageio	< any	UNKNOWN
ubuntu	20.04	noarch	openimageio	< any	UNKNOWN
ubuntu	22.04	noarch	openimageio	< any	UNKNOWN
ubuntu	24.04	noarch	openimageio	< any	UNKNOWN
ubuntu	16.04	noarch	openimageio	< any	UNKNOWN