HEIF Heap OOB Read in OpenImageIO
Summary
HEIF Heap OOB Read in OpenImageIO
Original description
The description as published by the source.
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seek_subimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-40630 openimageio
- Ubuntu UBUNTU-CVE-2024-40630 openimageio
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com