CVE-2023-3430

Name	CVE-2023-3430
Description	A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openimageio (PTS)	bookworm	2.4.7.1+dfsg-2	vulnerable
	trixie	2.5.18.0+dfsg-1	fixed
	forky, sid	2.5.19.1+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openimageio	source	(unstable)	2.4.13.0+dfsg-1

Notes

[bookworm] - openimageio <no-dsa> (Minor issue)
[bullseye] - openimageio <no-dsa> (Minor issue)
[buster] - openimageio <no-dsa> (Minor issue)
https://github.com/OpenImageIO/oiio/issues/3840
https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/3841
https://github.com/OpenImageIO/oiio/commit/5ff2c56dd28e96f67ed8f80d8a3d1235e51f9957 (v2.4.12.0)