CVE-2009-1721

2009-07-3100:00:00

ubuntu.com

0.004 Low

EPSS

Percentile

74.8%

JSON

The decompression implementation in the Imf::hufUncompress function in
OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a
denial of service (application crash) or possibly execute arbitrary code
via vectors that trigger a free of an uninitialized pointer.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-1721>

Notes

Author	Note
mdeslaur	vendor patch doesn’t pass regression tests. upstream patch is better and passes the tests. for hardy, probably need to backport crasher fixes http://cvs.savannah.gnu.org/viewvc/OpenEXR/IlmImf/ImfHuf.cpp?root=openexr&r1=1.6&r2=1.7 http://cvs.savannah.gnu.org/viewvc/OpenEXR/IlmImf/ImfHuf.cpp?root=openexr&r1=1.7&r2=1.8

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchopenexr< 1.2.2-4.4ubuntu1.1UNKNOWN
ubuntu8.10noarchopenexr< 1.6.1-3ubuntu1.8.10.1UNKNOWN
ubuntu9.04noarchopenexr< 1.6.1-3ubuntu1.9.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	openexr	< 1.2.2-4.4ubuntu1.1	UNKNOWN
ubuntu	8.10	noarch	openexr	< 1.6.1-3ubuntu1.8.10.1	UNKNOWN
ubuntu	9.04	noarch	openexr	< 1.6.1-3ubuntu1.9.04.1	UNKNOWN