The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3518 advisory.

  - A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in     OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can     leak sensitive process information. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-41649)

  - A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the     image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary     memory address which can lead to denial of service. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-41684)

  - A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of     OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2022-41794)

  - An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of     OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory     corruption. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2022-41837)

  - A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project     OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker     can provide malicious input to trigger this vulnerability. (CVE-2023-24472)

  - Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary     code and obtain sensitive information via a crafted file to the readimg function. (CVE-2023-36183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3518-1 : openimageio - LTS security update

critical Nessus Plugin ID 179425

Version 1.0