Bug 888045 (CVE-2022-41649, CVE-2022-41837, CVE-2022-41981, CVE-2022-43600, CVE-2022-43601)

Summary:	<media-libs/openimageio-2.4.5.0: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	sci
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=879255 https://bugs.gentoo.org/show_bug.cgi?id=884085
Whiteboard:	B2 [glsa+]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-12-23 00:53:24 UTC

CVE-2022-41649 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1631):

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-41837 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1636):

An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-41981 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1628):

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-43600 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656):

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`

CVE-2022-43601 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656):

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`

TALOS just dumped a bunch of CVEs out of their system, many of which
are already addressed upstream according to release notes (bug 884085
and bug 879255 for us). Of course, they evidently didn't see it
necessary to note this in the CVEs.

These are the CVEs which I wasn't able to find in upstream's release notes, so I'm note sure if they're fixed.

Comment 1 John Helmert III archtester

2023-05-29 04:11:49 UTC

Fixed in 2.4.5 (according to tags containing the commits from PRs mentioned in CHANGES.md):

CVE-2022-41649: https://github.com/OpenImageIO/oiio/commit/884dfd6b7c1fd6130390853b5074ddeb48f2f19b
CVE-2022-41837: https://github.com/OpenImageIO/oiio/commit/884dfd6b7c1fd6130390853b5074ddeb48f2f19b
CVE-2022-41981: https://github.com/OpenImageIO/oiio/commit/19121dc4f0cca1e0ff53d616043d482f23169249
CVE-2022-43600: https://github.com/OpenImageIO/oiio/commit/209c1bfd46b5c637945d37f68e08211ac3c39680
CVE-2022-43601: https://github.com/OpenImageIO/oiio/commit/209c1bfd46b5c637945d37f68e08211ac3c39680

Comment 2 John Helmert III archtester

2023-05-29 04:19:31 UTC

GLSA request filed.

Comment 3 Larry the Git Cow gentoo-dev

2023-05-30 03:05:51 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=0778ce2129b0cfa807a5d5a2fab9ed1ccc9db6a9

commit 0778ce2129b0cfa807a5d5a2fab9ed1ccc9db6a9
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-05-30 03:02:13 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-05-30 03:05:03 +0000

    [ GLSA 202305-33 ] OpenImageIO: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/879255
    Bug: https://bugs.gentoo.org/884085
    Bug: https://bugs.gentoo.org/888045
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202305-33.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

Comment 4 John Helmert III archtester

2023-05-30 03:07:58 UTC

GLSA released, all done!