Skip to content
OpenAdvisories
Medium ALAS2-2020-1499 3 CVEs

Moderate: OpenEXR security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11764: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. 1828990: CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp CVE-2020-11763: An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. 1828995: CVE-2020-11763 OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp CVE-2020-11761: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. 1829002: CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 OpenEXR 0:1.7.1-8.amzn2.0.1
Amazon Linux · 2 OpenEXR-debuginfo 0:1.7.1-8.amzn2.0.1
Amazon Linux · 2 OpenEXR-devel 0:1.7.1-8.amzn2.0.1
Amazon Linux · 2 OpenEXR-libs 0:1.7.1-8.amzn2.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-11761.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-11763.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-11764.html