Gentoo alert 202506-09 (OpenImageIO)
| From: | glsamaker@gentoo.org | |
| To: | gentoo-announce@lists.gentoo.org | |
| Subject: | [gentoo-announce] [ GLSA 202506-09 ] OpenImageIO: Multiple Vulnerabilities | |
| Date: | Thu, 12 Jun 2025 08:57:14 -0000 | |
| Message-ID: | <174971863499.7.17897963548960313028@3f85d36892cf> |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202506-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: OpenImageIO: Multiple Vulnerabilities Date: June 12, 2025 Bugs: #903807, #917679 ID: 202506-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in OpenImageIO, the worst of which can lead to execution of arbitrary code. Background ========== OpenImageIO is a library for reading and writing images. Affected packages ================= Package Vulnerable Unaffected ---------------------- ------------ ------------ media-libs/openimageio < 2.5.4.0 >= 2.5.4.0 Description =========== Multiple vulnerabilities have been discovered in OpenImageIO. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All OpenImageIO users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/openimageio-2.5.4.0" References ========== [ 1 ] CVE-2023-22845 https://nvd.nist.gov/vuln/detail/CVE-2023-22845 [ 2 ] CVE-2023-24472 https://nvd.nist.gov/vuln/detail/CVE-2023-24472 [ 3 ] CVE-2023-24473 https://nvd.nist.gov/vuln/detail/CVE-2023-24473 [ 4 ] CVE-2023-36183 https://nvd.nist.gov/vuln/detail/CVE-2023-36183 [ 5 ] CVE-2023-42295 https://nvd.nist.gov/vuln/detail/CVE-2023-42295 [ 6 ] CVE-2023-42299 https://nvd.nist.gov/vuln/detail/CVE-2023-42299 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202506-09 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2025 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmhKlmoACgkQFMQkOaVy +9mibRAApGHJdwUxsuHjrsRwFNFO16wSuoSowAQBcIxx+ue3wTaBirhqYiaRJd8X me3gzCJbO/nu+N+Jl/cIlQyEH6zIWjPGyblLj4a8fyB+ie+k4ArDI9aUauisgVTu siwBdcLWMxMKdho3wGc3k3d2hfjssSUbHmsztF/9U4RHKIdpe4sd/8JpKzWgVcej ljCY8Ki1sszcujc/lim9aMi6/6EmwH2QgQ1K8W5qQmT9k6yVmIR1b7DBw9VUIiU/ FFCcSZxLQ5iyMtsvWIs0duZEaV/7raMbjUhBoudWYWlZ77hFWh1V+1GAN9LddwqJ yCDl3e9OAC4FZqVSVHtmuG5aj04qkjmJ2Kl1zPXW8ZRPHh24zAqzTkwmaX6BzcNm 0nDtoFrhuTjd0Gn49iajgu9c5k3aVMbiun+ZRTZrwz82Ddp7iiLz2AL3Ag5ANCMD gKz3NqWxvUc09DDowa1NVN4FY8134YasvLsCRccD/tZf1bG4LkDFVyEubPx1MjfT rxYLzIVm7TyVqfo4JC6jewNY8kdle079HGVg76IvGwSjfegZSAjGUbTnKNECDNrQ TCjZIzDh2eCvRoayxuo9AY+4gHnLYx5gR40chRRfLSZw4aLZRkTJiX5VGgFrWiL0 R9962fqNKsHB2nJPmiFF+J7wVDXuiFF/Q7+eynO3rQu65ElXRKs= =EBOx -----END PGP SIGNATURE-----