CVE-2022-41999: Null Pointer Dereference
A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2Fixed in 2.5.18.0+dfsg-1Fixed in 3.1.18.1+dfsg-2Fixed in 3.2.2.0+dfsg-1
Event History
Frequently Asked Questions
What is CVE-2022-41999?
CVE-2022-41999 is a denial of service vulnerability in the DDS native tile reading functionality of OpenImageIO.
What is the severity of CVE-2022-41999?
The severity of CVE-2022-41999 is not mentioned in the provided information.
How does CVE-2022-41999 work?
CVE-2022-41999 can be triggered by a specially-crafted .dds file, which can lead to denial of service.
How can I fix CVE-2022-41999?
To fix CVE-2022-41999, update OpenImageIO to version 2.0.5~dfsg0-1+deb10u2, 2.2.10.1+dfsg-1+deb11u1, 2.4.7.1+dfsg-2, or 2.4.13.0+dfsg-1.
Where can I find more information about CVE-2022-41999?
You can find more information about CVE-2022-41999 on the following references: [TALOS-2022-1635](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1635), [OpenImageIO pull request #3625](https://github.com/OpenImageIO/oiio/pull/3625), [OpenImageIO commit e44400feac32d455b49e9c8baffa52ed855ba59b](https://github.com/OpenImageIO/oiio/commit/e44400feac32d455b49e9c8baffa52ed855ba59b).