Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 888045 (CVE-2022-41649, CVE-2022-41837, CVE-2022-41981, CVE-2022-43600, CVE-2022-43601) - <media-libs/openimageio-2.4.5.0: multiple vulnerabilities
Summary: <media-libs/openimageio-2.4.5.0: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-41649, CVE-2022-41837, CVE-2022-41981, CVE-2022-43600, CVE-2022-43601
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-23 00:53 UTC by John Helmert III
Modified: 2023-05-30 03:07 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-12-23 00:53:24 UTC
CVE-2022-41649 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1631):

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-41837 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1636):

An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-41981 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1628):

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2022-43600 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656):

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`

CVE-2022-43601 (https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656):

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`

TALOS just dumped a bunch of CVEs out of their system, many of which
are already addressed upstream according to release notes (bug 884085
and bug 879255 for us). Of course, they evidently didn't see it
necessary to note this in the CVEs.

These are the CVEs which I wasn't able to find in upstream's release notes, so I'm note sure if they're fixed.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-05-29 04:19:31 UTC
GLSA request filed.
Comment 3 Larry the Git Cow gentoo-dev 2023-05-30 03:05:51 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=0778ce2129b0cfa807a5d5a2fab9ed1ccc9db6a9

commit 0778ce2129b0cfa807a5d5a2fab9ed1ccc9db6a9
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-05-30 03:02:13 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-05-30 03:05:03 +0000

    [ GLSA 202305-33 ] OpenImageIO: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/879255
    Bug: https://bugs.gentoo.org/884085
    Bug: https://bugs.gentoo.org/888045
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202305-33.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-05-30 03:07:58 UTC
GLSA released, all done!