// For flags

CVE-2022-36354

 

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability.

Existe una vulnerabilidad de lectura fuera de los límites en el analizador de formato RLA de OpenImageIO master-branch-9aeece7a y v2.3.19.0. Más específicamente, en la forma en que se manejan los intervalos de bytes codificados de longitud de ejecución. Un archivo RLA con formato incorrecto puede provocar una lectura fuera de los límites de metadatos del montón, lo que puede provocar una fuga de información confidencial. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad.

*Credits: Discovered by Lilith >_> of Cisco Talos.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-30 CVE Reserved
  • 2022-12-22 CVE Published
  • 2024-07-14 EPSS Updated
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-193: Off-by-one Error
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1629 2024-09-17
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openimageio
Search vendor "Openimageio"
 Openimageio
Search vendor "Openimageio" for product "Openimageio"
 2.3.19.0
Search vendor "Openimageio" for product "Openimageio" and version "2.3.19.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 11.0
Search vendor "Debian" for product "Debian Linux" and version "11.0"
-
Affected