DSA-5384: -1 openimageio -- security update
Multiple security vulnerabilities have been discovered in OpenImageIO, a library for reading and writing images. Buffer overflows and out-of-bounds read and write programming errors may lead to a denial of service (application crash) or the execution of arbitrary code if a malformed image file is processed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openimageioto a version that resolves this vulnerability.Patch DSA-5384-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2022-36354
- CVE-2022-41639
- CVE-2022-41649
- CVE-2022-41684
- CVE-2022-41794
- CVE-2022-41837
- CVE-2022-41838
- CVE-2022-41977
- CVE-2022-41981
- CVE-2022-41988
- CVE-2022-41999
- CVE-2022-43592
- CVE-2022-43593
- CVE-2022-43594
- CVE-2022-43595
- CVE-2022-43596
- CVE-2022-43597
- CVE-2022-43598
- CVE-2022-43599
- CVE-2022-43600
- CVE-2022-43601
- CVE-2022-43602
- CVE-2022-43603
Frequently Asked Questions
Who is exposed to these vulnerabilities?
Applications that use OpenImageIO to read or write image files are exposed when they process malformed image files. The reported outcomes include application crashes and possible arbitrary code execution.
What does an attacker need to exploit the issue?
An attacker needs a malformed image file to be processed by an application using the affected library. The available information does not state whether authentication, local access, or a specific configuration is required.
How can administrators identify potentially affected systems?
Identify systems running applications that depend on the Debian openimageio package and that process image files. The provided advisory does not include affected or fixed package version information.