rpm package
opensuse/OpenImageIO&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/OpenImageIO&distro=openSUSE%20Tumbleweed
Vulnerabilities (32)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-67549 | Hig | 7.6 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinpu | |
| CVE-2026-65970 | Med | 5.3 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through | |
| CVE-2026-65969 | Med | 5.5 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() | |
| CVE-2026-63638 | Hig | 8.3 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to | |
| CVE-2026-63635 | Med | 5.5 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata | |
| CVE-2026-63422 | Hig | 7.8 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow wh | |
| CVE-2026-63420 | Med | 5.5 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels | |
| CVE-2026-63419 | Hig | 7.8 | < 3.1.16.0-1.1 | 3.1.16.0-1.1 | Sep 18, 2026 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit | |
| CVE-2026-7582 | Med | 5.3 | < 3.1.13.1-2.1 | 3.1.13.1-2.1 | May 1, 2026 | A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be ap | |
| CVE-2024-55194 | Cri | 9.8 | < 3.1.14.0-1.1 | 3.1.14.0-1.1 | Jan 23, 2025 | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h. | |
| CVE-2024-40630 | Med | 4.3 | < 2.5.13.1-1.1 | 2.5.13.1-1.1 | Jul 15, 2024 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in th | |
| CVE-2023-24473 | Med | 5.3 | < 2.4.8.1-1.1 | 2.4.8.1-1.1 | Mar 30, 2023 | An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this v | |
| CVE-2023-24472 | Hig | 7.5 | < 2.4.8.1-1.1 | 2.4.8.1-1.1 | Mar 30, 2023 | A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability. | |
| CVE-2023-22845 | Hig | 7.5 | < 2.4.8.1-1.1 | 2.4.8.1-1.1 | Mar 30, 2023 | An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. | |
| CVE-2022-4198 | Med | 4.8 | < 2.4.5.0-1.1 | 2.4.5.0-1.1 | Jan 2, 2023 | The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisi | |
| CVE-2022-43603 | Med | 5.9 | < 2.4.6.0-1.1 | 2.4.6.0-1.1 | Dec 22, 2022 | A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability. | |
| CVE-2022-43599 | Hig | 8.1 | < 2.4.6.0-1.1 | 2.4.6.0-1.1 | Dec 22, 2022 | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.T | |
| CVE-2022-43597 | Hig | 8.1 | < 2.4.6.0-1.1 | 2.4.6.0-1.1 | Dec 22, 2022 | Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vul | |
| CVE-2022-43596 | Med | 5.9 | < 2.4.6.0-1.1 | 2.4.6.0-1.1 | Dec 22, 2022 | An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerabili | |
| CVE-2022-43595 | Med | 5.9 | < 2.4.6.0-1.1 | 2.4.6.0-1.1 | Dec 22, 2022 | Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigg |
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinpu
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette()
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow wh
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels
- affected < 3.1.16.0-1.1fixed 3.1.16.0-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit
- affected < 3.1.13.1-2.1fixed 3.1.13.1-2.1
A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be ap
- affected < 3.1.14.0-1.1fixed 3.1.14.0-1.1
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
- affected < 2.5.13.1-1.1fixed 2.5.13.1-1.1
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in th
- affected < 2.4.8.1-1.1fixed 2.4.8.1-1.1
An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this v
- affected < 2.4.8.1-1.1fixed 2.4.8.1-1.1
A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.
- affected < 2.4.8.1-1.1fixed 2.4.8.1-1.1
An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
- affected < 2.4.5.0-1.1fixed 2.4.5.0-1.1
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisi
- affected < 2.4.6.0-1.1fixed 2.4.6.0-1.1
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- affected < 2.4.6.0-1.1fixed 2.4.6.0-1.1
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.T
- affected < 2.4.6.0-1.1fixed 2.4.6.0-1.1
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vul
- affected < 2.4.6.0-1.1fixed 2.4.6.0-1.1
An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerabili
- affected < 2.4.6.0-1.1fixed 2.4.6.0-1.1
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigg
Page 1 of 2