Vulnerability · Published Dec 18, 2023 · Assigned by redhat
CVE-2023-3430Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp
High 7.5
In plain English
A high-severity heap buffer overflow in Extra Packages for Enterprise Linux from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | openimageio | no fix listed | DEBIAN-CVE-2023-3430 |
| Debian:13 | openimageio | 2.4.13.0+dfsg-1 | DEBIAN-CVE-2023-3430 |
| Debian:14 | openimageio | 2.4.13.0+dfsg-1 | DEBIAN-CVE-2023-3430 |
| Ubuntu:22.04:LTS | openimageio | no fix listed | UBUNTU-CVE-2023-3430 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | OpenImageIO | see references |
| Fedora | Extra Packages for Enterprise Linux | see references |
| Fedora | Fedora | see references |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHBZ#2218380 issue-tracking, x_refsource_REDHAT