Summary
It was discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. These issues only affected Ubuntu 20.04 ESM. (CVE-2021-3598,
CVE-2021-3605, CVE-2021-20296, CVE-2021-23215, CVE-2021-26260)
It was discovered that OpenEXR incorrectly handled certain EXR
image files. An attacker could possibly use this issue to cause a crash
or execute arbitrary code. (CVE-2021-3933)
It was discovered that OpenEXR incorrectly handled certain EXR image files.
An attacker could possibly use this issue to cause a crash. (CVE-2021-3941)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | openexr | 2.3.0-6ubuntu0.5+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | openexr | 2.5.7-1ubuntu0.1~esm1 |
Vulnerabilities 7
-
Unscored —
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is proces…
-
Unscored —
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.…
-
Unscored —
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.…
-
Unscored —
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able …
-
Unscored —
There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a…
-
Unscored —
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cau…
-
Unscored —
In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x …
References
-
report
https://ubuntu.com/security/CVE-2021-3598
-
report
https://ubuntu.com/security/CVE-2021-3605
-
report
https://ubuntu.com/security/CVE-2021-3933
-
report
https://ubuntu.com/security/CVE-2021-3941
-
report
https://ubuntu.com/security/CVE-2021-20296
-
report
https://ubuntu.com/security/CVE-2021-23215
-
report
https://ubuntu.com/security/CVE-2021-26260