Description
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AcademySoftwareFoundation OpenImageIO
Default version status: unaffected
0 to < 3.0.20.0affected3.1.0.0 to < 3.1.15.0affected3.2.0.0-dev to < 3.2.0.3-beta1affected
pkg:pypi/openimageioReferences
- https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5567 ↗
- https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5568 ↗
- https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613 ↗
- https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/v3.0.19.0/src/cineon.imageio/libcineon/Codec.cpp#L79-L82 ↗
- https://www.vulncheck.com/advisories/openimageio-before-3.0.20.0-3.1-x-before-3.1.15.0-and-3.2-x-before-3.2.0.3-beta1-cineon-reader-heap-out-of-bounds-read ↗