OESA-2022-1775

Dashboard / Vulnerabilities / OESA-2022-1775

OESA-2022-1775

Summary: OpenEXR security update

Details: OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fix(es): A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.(CVE-2021-20300) A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.(CVE-2021-20302) An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.(CVE-2021-3933)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1775, https://nvd.nist.gov/vuln/detail/CVE-2021-20300, https://nvd.nist.gov/vuln/detail/CVE-2021-20302, https://nvd.nist.gov/vuln/detail/CVE-2021-3933