An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory     corruption. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41837)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3518 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3518-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 07, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openimageio     Version        : 2.0.5~dfsg0-1+deb10u2     CVE ID         : CVE-2022-41649 CVE-2022-41684 CVE-2022-41794 CVE-2022-41837                      CVE-2023-24472 CVE-2023-36183     Debian Bug     : 1027143 1034151

    Multiple security vulnerabilities have been discovered in OpenImageIO, a     library for reading and writing images. Buffer overflows and out-of-bounds     read and write programming errors may lead to a denial of service     (application crash) or the execution of arbitrary code if a malformed image     file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.0.5~dfsg0-1+deb10u2.

    We recommend that you upgrade your openimageio packages.

    For the detailed security status of openimageio please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openimageio

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202305-33 (OpenImageIO: Multiple Vulnerabilities)

  - The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings,     which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even     when the unfiltered_html capability is disallowed (for example in multisite setup). (CVE-2022-4198)

  - A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-     branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A     malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive     information leak. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-36354)

  - A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP     images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to     arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
    (CVE-2022-38143)

  - A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in     OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of     bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a     malicious file to trigger this vulnerability. (CVE-2022-41639)

  - A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in     OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can     leak sensitive process information. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-41649)

  - A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the     image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary     memory address which can lead to denial of service. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-41684)

  - A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of     OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2022-41794)

  - An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory     corruption. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41837)

  - A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide     a malicious file to trigger this vulnerability. (CVE-2022-41838)

  - An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string     fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker     can provide a malicious file to trigger this vulnerability. (CVE-2022-41977)

  - A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0.
    A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can     lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
    (CVE-2022-41981)

  - An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of     OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of     sensitive information. An attacker can provide a malicious file to trigger this vulnerability.
    (CVE-2022-41988)

  - A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO     Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41999)

  - An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An     attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43592)

  - A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An     attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43593)

  - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer     dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This     vulnerability applies to writing .bmp files. (CVE-2022-43594)

  - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer     dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This     vulnerability applies to writing .fits files. (CVE-2022-43595)

  - An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap     data. An attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43596)

  - Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary     code execution. An attacker can provide malicious input to trigger these vulnerabilities.This     vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`. (CVE-2022-43597)

  - Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary     code execution. An attacker can provide malicious input to trigger these vulnerabilities.This     vulnerability arises when the `m_spec.format` is `TypeDesc::UINT16`. (CVE-2022-43598)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` (CVE-2022-43599)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` (CVE-2022-43600)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` (CVE-2022-43601)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` (CVE-2022-43602)

  - A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker     can provide a malicious file to trigger this vulnerability. (CVE-2022-43603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5384 advisory.

  - A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-     branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A     malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive     information leak. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-36354)

  - A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in     OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of     bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a     malicious file to trigger this vulnerability. (CVE-2022-41639)

  - A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in     OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can     leak sensitive process information. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-41649)

  - A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the     image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary     memory address which can lead to denial of service. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-41684)

  - A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of     OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2022-41794)

  - An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory     corruption. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41837)

  - A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide     a malicious file to trigger this vulnerability. (CVE-2022-41838)

  - An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string     fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker     can provide a malicious file to trigger this vulnerability. (CVE-2022-41977)

  - A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0.
    A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can     lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
    (CVE-2022-41981)

  - An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of     OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of     sensitive information. An attacker can provide a malicious file to trigger this vulnerability.
    (CVE-2022-41988)

  - A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO     Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41999)

  - An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An     attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43592)

  - A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An     attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43593)

  - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer     dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This     vulnerability applies to writing .bmp files. (CVE-2022-43594)

  - Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer     dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This     vulnerability applies to writing .fits files. (CVE-2022-43595)

  - An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap     data. An attacker can provide malicious input to trigger this vulnerability. (CVE-2022-43596)

  - Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary     code execution. An attacker can provide malicious input to trigger these vulnerabilities.This     vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`. (CVE-2022-43597)

  - Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary     code execution. An attacker can provide malicious input to trigger these vulnerabilities.This     vulnerability arises when the `m_spec.format` is `TypeDesc::UINT16`. (CVE-2022-43598)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` (CVE-2022-43599)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` (CVE-2022-43600)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` (CVE-2022-43601)

  - Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO     Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow.
    An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when     the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` (CVE-2022-43602)

  - A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker     can provide a malicious file to trigger this vulnerability. (CVE-2022-43603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258261	Linux Distros Unpatched Vulnerability : CVE-2022-41837	Nessus	Misc.	critical
179425	Debian dla-3518 : libopenimageio-dev - security update	Nessus	Debian Local Security Checks	critical
176473	GLSA-202305-33 : OpenImageIO: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
174046	Debian DSA-5384-1 : openimageio - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-41837

critical

Tenable Plugins

critical

critical

critical

critical