3239 matches found
PT-2025-46203
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.4 OpenEXR versions 3.3.0 through 3.3.5 OpenEXR versions 3.4.0 through 3.4.2 Description OpenEXR is an image storage format used in the motion picture industry. A use-after-free condition exists in the PyObjec...
CVE-2025-64182: Buffer Copy without Checking Size of Input
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter the deprecated...
OpenEXR 安全漏洞
OpenEXR is an open standard for a high dynamic range image HDR file format open sourced by the Academy Software Foundation. A security vulnerability exists in OpenEXR versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, which stems from a memory safety issue in the OpenEXR...
CVE-2025-64183: Use After Free
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObjectStealAttrString of pyOpenEXRold.cpp...
openexr:openexr_exrcheck_fuzzer: Segv on unknown address in ojph::local::param_cod::~param_cod
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=4747953106649088 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcheckfuzzer Job Type: libfuzzerasanopenexr Platform Id: linux Crash Type: Segv on unknown address...
FreeBSD : OpenEXR < 3.4.3 -- multiple vulnerabilities (c71a3914-ba96-11f0-aada-f59a8ea34d12)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c71a3914-ba96-11f0-aada-f59a8ea34d12 advisory. Cary Phillips reports: Patch release that addresses several bugs, primarily involving properly rejectin...
openexr:openexr_exrcheck_fuzzer: Segv on unknown address in ojph::local::param_cod::~param_cod
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5117045885960192 Project: openexr Fuzzing Engine: afl Fuzz Target: openexrexrcheckfuzzer Job Type: aflasanopenexr Platform Id: linux Crash Type: Segv on unknown address Crash...
openexr:openexr_exrcheck_fuzzer: Crash in ojph::local::param_cod::~param_cod
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=4759156830830592 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcheckfuzzer Job Type: libfuzzerasanopenexr Platform Id: linux Crash Type: UNKNOWN READ Crash...
PT-2025-46201
Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.5 OpenEXR versions 3.4.0 through 3.4.2 Description OpenEXR is an image storage format used in the motion picture industry. A flaw exists due to a conditional branch based on uninitialized data within the...
openexr:openexr_exrcheck_fuzzer: Heap-buffer-overflow in generic_unpack
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=4646486379134976 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcheckfuzzer Job Type: libfuzzerasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow RE...
OpenJPH < 0.24.5 -- multiple vulnerabilities
Aous Naman reports several vulnerabilities fixed in OpenJPH versions up to 0.24.5 and credits Cary Phillips for reporting them from the OSS-fuzz project. 0.24.5 Addresses OpenEXR OSS-fuzz issue 5747129672073216 that can cause heap corruption. 0.24.4... we now check that the ATK marker segment...
OpenEXR < 3.4.3 -- multiple vulnerabilities
Cary Phillips reports: Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data. He goes on to report various relevant items including heap buffer overflows, use-after-free, use of uninitialized memory and other bugs, several of them found by OSS-fuzz,...
OpenEXR has an unspecified vulnerability (CNVD-2025-24792)
OpenEXR is an open standard for high dynamic range image HDR file formats. A security vulnerability exists in versions prior to OpenEXR 8.0, which can be exploited by an attacker to cause an out-of-bounds write...
OpenEXR has an unspecified vulnerability (CNVD-2025-24791)
OpenEXR is an open standard for high dynamic range image HDR file formats. A security vulnerability exists in OpenEXR that can be exploited by attackers to cause a buffer overflow...
OpenEXR has an unspecified vulnerability (CNVD-2025-24790)
OpenEXR is an open standard for high dynamic range image HDR file formats. A security vulnerability exists in versions prior to OpenEXR 8.0, which can be exploited by an attacker to cause heap memory corruption...
The vulnerability of the dwa_uncompress() function in the OpenEXR File Decoder component of the FFmpeg multimedia library allows a malicious actor to execute arbitrary code.
The vulnerability of the dwauncompress function in the OpenEXR File Decoder component of the FFmpeg multimedia library lies in the fact that the operation’s output goes beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Linux Distros Unpatched Vulnerability : CVE-2025-59733
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type and size, and...
Linux Distros Unpatched Vulnerability : CVE-2025-59731
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length- encoded data is not checked when using it to calculate...
Linux Distros Unpatched Vulnerability : CVE-2025-59732
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or...
