CVE-2022-41977

An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627	Exploit Third Party Advisory
https://www.debian.org/security/2023/dsa-5384
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627	Exploit Third Party Advisory
https://www.debian.org/security/2023/dsa-5384

Configurations

Configuration 1 (hide)

cpe:2.3:a:openimageio:openimageio:2.3.19.0:*:*:*:*:*:*:*

History

21 Nov 2024, 07:24

Type	Values Removed	Values Added
References	~~() https://security.gentoo.org/glsa/202305-33 -~~	() https://security.gentoo.org/glsa/202305-33 -
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627 - Exploit, Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627 - Exploit, Third Party Advisory
References	~~() https://www.debian.org/security/2023/dsa-5384 -~~	() https://www.debian.org/security/2023/dsa-5384 -
Summary		(es) Existe una vulnerabilidad de lectura fuera de los límites en la forma en que OpenImageIO versión v2.3.19.0 procesa campos de cadena en archivos de imagen TIFF. Un archivo TIFF especialmente diseñado puede dar lugar a la divulgación de información. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad.

Information

Published : 2022-12-22 22:15

Updated : 2024-11-21 07:24

NVD link : CVE-2022-41977

Mitre link : CVE-2022-41977

CVE.ORG link : CVE-2022-41977

JSON object : View

Products Affected

openimageio

openimageio

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2022-41977", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2022-12-22T22:15:15.830", "references": [{"url": "https://security.gentoo.org/glsa/202305-33", "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://www.debian.org/security/2023/dsa-5384", "source": "talos-cna@cisco.com"}, {"url": "https://security.gentoo.org/glsa/202305-33", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2023/dsa-5384", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-125"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de lectura fuera de los l\u00edmites en la forma en que OpenImageIO versi\u00f3n v2.3.19.0 procesa campos de cadena en archivos de imagen TIFF. Un archivo TIFF especialmente dise\u00f1ado puede dar lugar a la divulgaci\u00f3n de informaci\u00f3n. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad."}], "lastModified": "2024-11-21T07:24:11.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openimageio:openimageio:2.3.19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06112B1B-FC3F-425D-A78A-F7B7FD8AC1F9"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}