CVE-2022-41999: Null Pointer Dereference
A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41999?
CVE-2022-41999 is a denial of service vulnerability in the DDS native tile reading functionality of OpenImageIO.
What is the severity of CVE-2022-41999?
The severity of CVE-2022-41999 is not mentioned in the provided information.
How does CVE-2022-41999 work?
CVE-2022-41999 can be triggered by a specially-crafted .dds file, which can lead to denial of service.
How can I fix CVE-2022-41999?
To fix CVE-2022-41999, update OpenImageIO to version 2.0.5~dfsg0-1+deb10u2, 2.2.10.1+dfsg-1+deb11u1, 2.4.7.1+dfsg-2, or 2.4.13.0+dfsg-1.
Where can I find more information about CVE-2022-41999?
You can find more information about CVE-2022-41999 on the following references: [TALOS-2022-1635](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1635), [OpenImageIO pull request #3625](https://github.com/OpenImageIO/oiio/pull/3625), [OpenImageIO commit e44400feac32d455b49e9c8baffa52ed855ba59b](https://github.com/OpenImageIO/oiio/commit/e44400feac32d455b49e9c8baffa52ed855ba59b).