CVE-2022-43597: High severity Openimageio Openimageio vulnerability
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the mspec.format is TypeDesc::UINT8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2Fixed in 2.5.18.0+dfsg-1Fixed in 3.1.18.1+dfsg-2Fixed in 3.2.2.0+dfsg-1
Event History
Frequently Asked Questions
What is CVE-2022-43597?
CVE-2022-43597 is a memory corruption vulnerability in OpenImageIO v2.4.4.2's IFFOutput alignment padding functionality.
How does CVE-2022-43597 impact OpenImageIO?
CVE-2022-43597 can lead to arbitrary code execution if a specially crafted ImageOutput Object is provided as input.
Which versions of OpenImageIO are affected by CVE-2022-43597?
OpenImageIO versions 2.0.5~dfsg0-1+deb10u2, 2.2.10.1+dfsg-1+deb11u1, 2.4.7.1+dfsg-2, and 2.4.13.0+dfsg-1 are affected by CVE-2022-43597.
How can an attacker exploit CVE-2022-43597?
An attacker can exploit CVE-2022-43597 by providing malicious input to trigger the memory corruption vulnerabilities.
Is there a fix for CVE-2022-43597?
Yes, Debian has released fixes for CVE-2022-43597 for the affected versions of OpenImageIO.