CVE-2022-43601: Buffer Overflow
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the ymax variable is set to 0xFFFF and mspec.format is TypeDesc::UINT16
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 2.4.7.1+dfsg-2Fixed in 2.5.18.0+dfsg-1Fixed in 3.1.18.1+dfsg-2Fixed in 3.2.2.0+dfsg-1
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-43601.
What is the severity of CVE-2022-43601?
The severity of CVE-2022-43601 is high with a CVSS score of 8.1.
Which software is affected by CVE-2022-43601?
OpenImageIO Project OpenImageIO v2.4.4.2 and Debian Linux 11.0 are affected by CVE-2022-43601.
How can an attacker exploit CVE-2022-43601?
An attacker can exploit CVE-2022-43601 by providing malicious input to trigger heap buffer overflows in the IFFOutput::close() functionality of OpenImageIO.
Are there any references for CVE-2022-43601?
Yes, you can find references for CVE-2022-43601 at the following links: [Gentoo Security Advisory](https://security.gentoo.org/glsa/202305-33), [Talos Intelligence Vulnerability Report](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656), [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5384).