HEIF Heap OOB Read in OpenImageIO
概要
HEIF Heap OOB Read in OpenImageIO
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-40630 openimageio
- Ubuntu UBUNTU-CVE-2024-40630 openimageio
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com