CVE-2022-41684: 
NixOS vulnerability analysis and mitigation

A heap out of bounds read vulnerability (CVE-2022-41684) was discovered in OpenImageIO master-branch-9aeece7a. The vulnerability affects the PSD format image file directory parsing functionality. The issue was discovered by Lilith of Cisco Talos and was disclosed on October 19, 2022 (Talos Report).

The vulnerability exists in the way OpenImageIO processes PSD format files. A specially-crafted .psd file can cause a read of arbitrary memory address when parsing the image file directory part of a PSD image file. The vulnerability has been assigned a CVSS score of 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is categorized as CWE-125 (Out-of-bounds Read) (Talos Report).

When exploited, this vulnerability can lead to denial of service conditions through application crashes. The vulnerability allows an attacker to cause a read of arbitrary memory addresses, which can result in program termination (Talos Report).

The vulnerability was patched in OpenImageIO version 2.3.19.0 and v2.4.4.2. Users are advised to upgrade to these or later versions. The issue was initially reported to the vendor on October 19, 2022, and a patch was released on November 1, 2022 (Talos Report, Debian Security).