A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker     can provide malicious input to trigger this vulnerability. (CVE-2023-24472)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3518 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3518-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 07, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openimageio     Version        : 2.0.5~dfsg0-1+deb10u2     CVE ID         : CVE-2022-41649 CVE-2022-41684 CVE-2022-41794 CVE-2022-41837                      CVE-2023-24472 CVE-2023-36183     Debian Bug     : 1027143 1034151

    Multiple security vulnerabilities have been discovered in OpenImageIO, a     library for reading and writing images. Buffer overflows and out-of-bounds     read and write programming errors may lead to a denial of service     (application crash) or the execution of arbitrary code if a malformed image     file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.0.5~dfsg0-1+deb10u2.

    We recommend that you upgrade your openimageio packages.

    For the detailed security status of openimageio please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openimageio

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c3d65c8f7b advisory.

    Release 2.4.8.1 (13 Feb 2023) -- compared to 2.4.8.0

    * Fix(targa): guard against corrupted tga files Fixes TALOS-2023-1707 /     CVE-2023-24473, TALOS-2023-1708 / CVE-2023-22845. #3768
    * Fix: race condition in TIFF reader, fixes TALOS-2023-1709 / CVE-2023-24472.
    * Windows: Fix unresolved external symbol for MSVS 2017 #3763
    * Fix: Initialize OpenEXROutput::m_levelmode in init(). #3764
    * Fix: improve thread safety for concurrent tiff loads. #3767
    * Fix(fits): Make sure to close if open fails to find right magic number.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
225881	Linux Distros Unpatched Vulnerability : CVE-2023-24472	Nessus	Misc.	high
179425	Debian dla-3518 : libopenimageio-dev - security update	Nessus	Debian Local Security Checks	critical
171777	Fedora 37 : OpenImageIO (2023-c3d65c8f7b)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-24472

high

Tenable Plugins

high

critical

high