CVE-2021-20298: Uncontrolled Resource Consumption

A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability...

CVE-2021-20304

OpenEXR contains a vulnerable hufDecode path (CVE-2021-20304). A crafted EXR file can trigger an undefined right-shift error, with the highest impact on availability. Public advisories document affected OpenEXR components and remediation via vendor patches/upgrades. Notably, Amazon Linux 2 ALAS a...

CVE-2021-20304

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability...

CVE-2021-20304

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability...

CVE-2021-20304: Integer Overflow or Wraparound

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability...

CVE-2021-20304

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability...

openexr:openexr_exrcorecheck_fuzzer: Heap-buffer-overflow in fasthuf_decode

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5653081433440256 Project: openexr Fuzzing Engine: libFuzzer Fuzz Target: openexrexrcorecheckfuzzer Job Type: libfuzzerasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflo...

OESA-2022-1775 OpenEXR security update

OpenEXR is a high dynamic-range HDR image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fixes: A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a...

tinyexr 缓冲区错误漏洞

tinyexr is a small, header-only library by the Japanese individual developer Syoyo Fujita. It is used to load and save OpenEXR .exr images. A security vulnerability exists in tinyexr version 1.0.1, which stems from a heap-based buffer over-read in tinyexr::DecodePixelData...

EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2022-1750)

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an...

Huawei EulerOS: Security Advisory for OpenEXR (EulerOS-SA-2022-1750)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-36991

Name of the Vulnerable Software and Affected Versions OpenEXR affected versions not specified Description The issue is related to a heap buffer overflow read. Technical details about the crash include the generic unpack and exr decoding run functions, as well as the Imf 3 2::checkCoreFile functio...

openexr:openexr_exrcorecheck_fuzzer: Heap-buffer-overflow in uncompress_b44_impl

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5479947201806336 Project: openexr Fuzzing Engine: honggfuzz Fuzz Target: openexrexrcorecheckfuzzer Job Type: honggfuzzasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflo...

new packages: openexr

An update is available for openexr. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

openexr:openexr_exrcorecheck_fuzzer: Heap-buffer-overflow in generic_unpack

Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5266494809833472 Project: openexr Fuzzing Engine: afl Fuzz Target: openexrexrcorecheckfuzzer Job Type: aflasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Cra...

GHSA-8M57-J273-2QG9 OpenEXR invalid read

In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash...

GHSA-QXH9-R8XW-7V99 OpenEXR invalid write

In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code...

OpenEXR invalid write

In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code...

OpenEXR invalid read

In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash...

OESA-2022-1639 OpenEXR security update

OpenEXR is a high dynamic-range HDR image file format originally developed by Industrial Light and Magic for use in computer imaging applications. Security Fixes: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from...