CVE-2022-43595
5.9
MEDIUM
CVSS 3.1
EPSS 0.70%
Description
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files.
How to fix CVE-2022-43595
To remediate CVE-2022-43595, upgrade the affected package to a fixed version below.
- —upgrade to 2.2.10.1+dfsg-1+deb11u1 or later
Is CVE-2022-43595 being exploited?
Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.2.10.1+dfsg-1+deb11u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |