A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability.
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openimageio | Openimageio | 2.3.19.0 (including) | 2.3.19.0 (including) |
| Openimageio | Ubuntu | bionic | * |
| Openimageio | Ubuntu | kinetic | * |
| Openimageio | Ubuntu | lunar | * |
| Openimageio | Ubuntu | mantic | * |
| Openimageio | Ubuntu | trusty | * |
| Openimageio | Ubuntu | xenial | * |