Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.

The remote host is affected by the vulnerability described in GLSA-202506-09 (OpenImageIO: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenImageIO. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary     code and obtain sensitive information via a crafted file to the readimg function. (CVE-2023-36183)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ad5fee9a64 advisory.

    Changes since 2.4.12:
    https://github.com/OpenImageIO/oiio/releases/tag/v2.4.13.0     https://github.com/OpenImageIO/oiio/releases/tag/v2.4.14.0     Security fix for CVE-2023-36183, CVE-2023-3430


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-99870af9f0 advisory.

    Changes since 2.4.12:
    https://github.com/OpenImageIO/oiio/releases/tag/v2.4.13.0     https://github.com/OpenImageIO/oiio/releases/tag/v2.4.14.0     Security fix for CVE-2023-36183, CVE-2023-3430



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3518 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3518-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 07, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openimageio     Version        : 2.0.5~dfsg0-1+deb10u2     CVE ID         : CVE-2022-41649 CVE-2022-41684 CVE-2022-41794 CVE-2022-41837                      CVE-2023-24472 CVE-2023-36183     Debian Bug     : 1027143 1034151

    Multiple security vulnerabilities have been discovered in OpenImageIO, a     library for reading and writing images. Buffer overflows and out-of-bounds     read and write programming errors may lead to a denial of service     (application crash) or the execution of arbitrary code if a malformed image     file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.0.5~dfsg0-1+deb10u2.

    We recommend that you upgrade your openimageio packages.

    For the detailed security status of openimageio please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openimageio

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240458	GLSA-202506-09 : OpenImageIO: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
225929	Linux Distros Unpatched Vulnerability : CVE-2023-36183	Nessus	Misc.	high
179690	Fedora 38 : OpenImageIO (2023-ad5fee9a64)	Nessus	Fedora Local Security Checks	high
179689	Fedora 37 : OpenImageIO (2023-99870af9f0)	Nessus	Fedora Local Security Checks	high
179425	Debian dla-3518 : libopenimageio-dev - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-36183

high

Tenable Plugins

critical

high

high

high

critical