OESA-2021-1060

Dashboard / Vulnerabilities / OESA-2021-1060

OESA-2021-1060

Summary: OpenEXR security update

Details: OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fix(es): In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.(CVE-2017-9114) In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.(CVE-2017-9110) In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.(CVE-2017-9112) In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.(CVE-2017-9111) In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.(CVE-2017-9116) In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.(CVE-2017-9115) In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.(CVE-2017-9113) In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.(CVE-2017-12596)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1060, https://nvd.nist.gov/vuln/detail/CVE-2017-9114, https://nvd.nist.gov/vuln/detail/CVE-2017-9110, https://nvd.nist.gov/vuln/detail/CVE-2017-9112, https://nvd.nist.gov/vuln/detail/CVE-2017-9111, https://nvd.nist.gov/vuln/detail/CVE-2017-9116, https://nvd.nist.gov/vuln/detail/CVE-2017-9115, https://nvd.nist.gov/vuln/detail/CVE-2017-9113, https://nvd.nist.gov/vuln/detail/CVE-2017-12596