Industrial Light and Magic OpenEXR Buffer Overflow Vulnerability (CNVD-2022-19852)

2021-08-0700:00:00

China National Vulnerability Database

www.cnvd.org.cn

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

JSON

OpenEXR is an image file format for high dynamic range (HDR) images from Industrial Light and Magic (LIM), Inc. A buffer overflow vulnerability exists in Industrial Light and Magic OpenEXR, which stems from the product’s Imf_2_5:: copyIntoFrameBuffer contains a heap buffer overflow, which can be exploited by attackers to execute malicious code.