CVE-2022-43601: Buffer Overflow
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the ymax variable is set to 0xFFFF and mspec.format is TypeDesc::UINT16
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-43601.
What is the severity of CVE-2022-43601?
The severity of CVE-2022-43601 is high with a CVSS score of 8.1.
Which software is affected by CVE-2022-43601?
OpenImageIO Project OpenImageIO v2.4.4.2 and Debian Linux 11.0 are affected by CVE-2022-43601.
How can an attacker exploit CVE-2022-43601?
An attacker can exploit CVE-2022-43601 by providing malicious input to trigger heap buffer overflows in the IFFOutput::close() functionality of OpenImageIO.
Are there any references for CVE-2022-43601?
Yes, you can find references for CVE-2022-43601 at the following links: [Gentoo Security Advisory](https://security.gentoo.org/glsa/202305-33), [Talos Intelligence Vulnerability Report](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656), [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5384).