CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .bmp files.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.gentoo.org/glsa/202305-33	Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653	Exploit Third Party Advisory
https://www.debian.org/security/2023/dsa-5384	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openimageio:openimageio:2.4.4.2:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

01 Feb 2024, 17:06

Type	Values Removed	Values Added
References	~~(MISC) https://security.gentoo.org/glsa/202305-33 -~~	(MISC) https://security.gentoo.org/glsa/202305-33 - Third Party Advisory

30 May 2023, 06:15

Type	Values Removed	Values Added
References		(MISC) https://security.gentoo.org/glsa/202305-33 -

Information

Published : 2022-12-22 22:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-43594

Mitre link : CVE-2022-43594

CVE.ORG link : CVE-2022-43594

JSON object : View

Products Affected

openimageio

openimageio

debian

debian_linux

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2022-43594", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2022-12-22T22:15:16.227", "references": [{"url": "https://security.gentoo.org/glsa/202305-33", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://www.debian.org/security/2023/dsa-5384", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}, {"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .bmp files."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de Denegaci\u00f3n de Servicio (DoS) en la funcionalidad de cierre de salida de im\u00e1genes de OpenImageIO Project OpenImageIO v2.4.4.2. Los objetos ImageOutput especialmente manipulados pueden provocar m\u00faltiples desreferencias de puntero null. Un atacante puede proporcionar m\u00faltiples entradas maliciosas para desencadenar estas vulnerabilidades. Esta vulnerabilidad se aplica a la escritura de archivos .bmp. "}], "lastModified": "2024-02-01T17:06:31.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openimageio:openimageio:2.4.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68FA2862-ED3E-4743-AFB0-0D23977A805D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}