OESA-2021-1238

Dashboard / Vulnerabilities / OESA-2021-1238

OESA-2021-1238

Summary: OpenEXR security update

Details: OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fix(es): An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.(CVE-2021-26260) An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.(CVE-2021-23215) A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.(CVE-2021-23169)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1238, https://nvd.nist.gov/vuln/detail/CVE-2021-26260, https://nvd.nist.gov/vuln/detail/CVE-2021-23215, https://nvd.nist.gov/vuln/detail/CVE-2021-23169