PT-2017-4146

🗓️ 07 Aug 2017 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbu.gs👁 4 Views

Heap-based buffer over-read in OpenEXR hufDecode function during exrmaketiled causes DoS.

Reporter	Title	Published	Views	Family All 181
FreeBSD	OpenEXR -- multiple remote code execution and denial of service vulnerabilities	12 Jan 201700:00	–	freebsd
AlpineLinux	CVE-2017-12596	7 Aug 201701:00	–	alpinelinux
AlpineLinux	CVE-2017-9113	21 May 201718:00	–	alpinelinux
AlpineLinux	CVE-2017-9114	21 May 201718:00	–	alpinelinux
AlpineLinux	CVE-2017-9115	21 May 201718:00	–	alpinelinux
AlpineLinux	CVE-2017-9116	21 May 201718:00	–	alpinelinux
BDU FSTEC	The vulnerability of the uncompress function in ImfZip.cpp of the OpenEXR library, which allows a hacker to trigger a service failure	12 Jan 201800:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the operator function in the half.h component of software for storing OpenEXR images, which has a wide dynamic range of brightness levels. This vulnerability arises from the operation exceeding the permissible buffer data size, allowing an attacker to access confidential information or cause system failures.	8 Jul 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the `refill` function in the `ImfFastHuf.cpp` component of the software for storing OpenEXR images with a wide dynamic range of brightness levels. This vulnerability arises from the operation of writing data beyond the buffer boundaries in memory, allowing an attacker to cause a service failure.	8 Jul 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the `bufferedReadPixels` function in software for storing OpenEXR images with a wide dynamic range of brightness levels arises from insufficient validation of input data. This allows attackers to trigger service failures.	8 Jul 202100:00	–	bdu_fstec

Source	Link
wiki	www.wiki.astralinux.ru/pages/viewpage.action
osv	www.osv.dev/vulnerability/CVE-2017-12596
cve	www.cve.org/CVERecord
usn	www.usn.ubuntu.com/4148-1
bugzilla	www.bugzilla.suse.com/1052522
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2017-12596
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-9116
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-9111

05 Mar 2021 00:00Current

CVSS 3.17.8

CVSS 26.8

CVSS 38.8

EPSS0.03295

OpenEXR hufDecode exrmaketiled heap-based buffer over-read denial of service confidential information access