deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46871
Published: 2022-12-22
Description: An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1104
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1795697; https://lists.debian.org/debian-lts-announce/2023/01/msg00015.html; https://lists.debian.org/debian-lts-announce/2023/02/msg00018.html
CVE: CVE-2022-46872
Published: 2022-12-22
Description: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1799156; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46873
Published: 2022-12-22
Description: Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constrained by the specified Content Security Policy of the document. This vulnerability affects Firefox < 108.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1644790; https://security.gentoo.org/glsa/202305-06; https://www.mozilla.org/security/advisories/mfsa2022-51/
CVE: CVE-2022-46874
Published: 2022-12-22
Description: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1746139; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46875
Published: 2022-12-22
Description: The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1786188; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46877
Published: 2022-12-22
Description: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1795139; https://lists.debian.org/debian-lts-announce/2023/01/msg00015.html; https://lists.debian.org/debian-lts-announce/2023/02/msg00018.html
CVE: CVE-2022-46878
Published: 2022-12-22
Description: Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1782219%2C1797370%2C1797685%2C1801102%2C1801315%2C1802395; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46879
Published: 2022-12-22
Description: Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736224%2C1793407%2C1794249%2C1795845%2C1797682%2C1797720%2C1798494%2C1799479; https://security.gentoo.org/glsa/202305-06; https://www.mozilla.org/security/advisories/mfsa2022-51/
CVE: CVE-2022-46880
Published: 2022-12-22
Description: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1749292; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46881
Published: 2022-12-22
Description: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1770930; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46882
Published: 2022-12-22
Description: A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1789371; https://security.gentoo.org/glsa/202305-06; https://security.gentoo.org/glsa/202305-13
CVE: CVE-2022-46883
Published: 2022-12-22
Description: Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-88
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1584674%2C1791152%2C1792241%2C1792984%2C1793127%2C1794645; https://www.mozilla.org/security/advisories/mfsa2022-47/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1584674%2C1791152%2C1792241%2C1792984%2C1793127%2C1794645
CVE: CVE-2022-46885
Published: 2022-12-22
Description: Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 106.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1786818%2C1789729%2C1791363%2C1792041; https://www.mozilla.org/security/advisories/mfsa2022-44/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1786818%2C1789729%2C1791363%2C1792041
CVE: CVE-2020-26302
Published: 2022-12-22
Description: is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://github.com/arasatasaygin/is.js/issues/320; https://securitylab.github.com/advisories/GHSL-2020-295-redos-is.js; https://github.com/arasatasaygin/is.js/issues/320
CVE: CVE-2022-3794
Published: 2022-12-22
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6.  Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/jeg-elementor-kit/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/84b616fa-ff64-49e8-8c4a-7d7bfdf758be?source=cve
CVE: CVE-2022-3805
Published: 2022-12-22
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
CVSS Score: 8.6 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/jeg-elementor-kit/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve
CVE: CVE-2022-43857
Published: 2022-12-22
Description: IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface.   The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter.  IBM X-Force ID:  239301.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239301; https://www.ibm.com/support/pages/node/6850801; https://exchange.xforce.ibmcloud.com/vulnerabilities/239301
CVE: CVE-2022-43858
Published: 2022-12-22
Description: IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks by modifying a parameter thereby gaining access to their files through this interface.  IBM X-Force ID:  239303.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239303; https://www.ibm.com/support/pages/node/6850801; https://exchange.xforce.ibmcloud.com/vulnerabilities/239303
CVE: CVE-2022-43859
Published: 2022-12-22
Description: IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface.  IBM X-Force ID:  239304.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239304; https://www.ibm.com/support/pages/node/6850801; https://exchange.xforce.ibmcloud.com/vulnerabilities/239304
CVE: CVE-2022-22184
Published: 2022-12-22
Description: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). If a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute will propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Since this issue only affects 22.3R1, Juniper strongly encourages customers to move to 22.3R1-S1. Juniper SIRT felt that the need to promptly warn customers about this issue affecting the 22.3R1 versions of Junos OS and Junos OS Evolved warranted an Out of Cycle JSA. This issue affects: Juniper Networks Junos OS version 22.3R1. Juniper Networks Junos OS Evolved version 22.3R1-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 22.3R1. Juniper Networks Junos OS Evolved versions prior to 22.3R1-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://kb.juniper.net/JSA70175; https://kb.juniper.net/JSA70175
CVE: CVE-2022-22456
Published: 2022-12-22
Description: 
IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 225004.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225004; https://www.ibm.com/support/pages/node/6849247; https://exchange.xforce.ibmcloud.com/vulnerabilities/225004
CVE: CVE-2022-22457
Published: 2022-12-22
Description: IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user.  IBM X-Force ID:  225007.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225007; https://www.ibm.com/support/pages/node/6849247; https://exchange.xforce.ibmcloud.com/vulnerabilities/225007
CVE: CVE-2022-22458
Published: 2022-12-22
Description: 
IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Force ID: 225009.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225009; https://www.ibm.com/support/pages/node/6849247; https://exchange.xforce.ibmcloud.com/vulnerabilities/225009
CVE: CVE-2022-36354
Published: 2022-12-22
Description: A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-193, CWE-193
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1629; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1629
CVE: CVE-2022-38143
Published: 2022-12-22
Description: A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-123, CWE-787
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1630; https://security.gentoo.org/glsa/202305-33
CVE: CVE-2022-41639
Published: 2022-12-22
Description: A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1633; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-41649
Published: 2022-12-22
Description: A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00005.html; https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1631
CVE: CVE-2022-41684
Published: 2022-12-22
Description: A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00005.html; https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1632
CVE: CVE-2022-41794
Published: 2022-12-22
Description: A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00005.html; https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1626
CVE: CVE-2022-41837
Published: 2022-12-22
Description: An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-562, CWE-787
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00005.html; https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1636
CVE: CVE-2022-41838
Published: 2022-12-22
Description: A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1634; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-41977
Published: 2022-12-22
Description: An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-41981
Published: 2022-12-22
Description: A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-125, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1628; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1628
CVE: CVE-2022-41988
Published: 2022-12-22
Description: An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1643; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-41999
Published: 2022-12-22
Description: A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1635; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43592
Published: 2022-12-22
Description: An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1651; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43593
Published: 2022-12-22
Description: A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1652; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43594
Published: 2022-12-22
Description: Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .bmp files.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653; https://www.debian.org/security/2023/dsa-5384