CVE-2022-41981

Name	CVE-2022-41981
Description	A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3382-1, DSA-5384-1
Debian Bugs	1027143

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openimageio (PTS)	bookworm	2.4.7.1+dfsg-2	fixed
	trixie	2.5.18.0+dfsg-1	fixed
	forky, sid	2.5.19.1+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
openimageio	source	buster	2.0.5~dfsg0-1+deb10u1	DLA-3382-1
openimageio	source	bullseye	2.2.10.1+dfsg-1+deb11u1	DSA-5384-1
openimageio	source	(unstable)	2.4.7.1+dfsg-2		1027143

Notes

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1628
Prerequisite: https://github.com/OpenImageIO/oiio/commit/bc9c931092e973d5250dd22a714cf035827dae6d
https://github.com/OpenImageIO/oiio/commit/19121dc4f0cca1e0ff53d616043d482f23169249