Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.

The remote host is affected by the vulnerability described in GLSA-201312-07 (OpenEXR: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenEXR. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code or cause a       Denial of Service condition via unspecified vectors.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1720     Drew Yao discovered integer overflows in the preview and     compression code.

  - CVE-2009-1721     Drew Yao discovered that an uninitialised pointer could     be freed in the decompression code.

  - CVE-2009-1722     A buffer overflow was discovered in the compression     code.

Multiple vulnerabilities has been found and corrected in OpenEXR :

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information (CVE-2009-1720).

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer (CVE-2009-1721).

Buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2009-1722).

This update provides fixes for these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update of OpenEXR fixes seceral integer overflows (CVE-2009-1720) and a denial-of-service (probably execution of arbitrary code) bug (CVE-2009-1721).

This update of OpenEXR fixes several integer overflows (CVE-2009-1720), a denial-of-service (probably execution of arbitrary code) bug (CVE-2009-1721) and another possible remote code execution bug in the compression code. (CVE-2009-1721)

This update of OpenEXR fixes several integer overflows (CVE-2009-1720) and a denial-of-service (probably execution of arbitrary code) bug.
(CVE-2009-1721)

Drew Yao discovered several flaws in the way OpenEXR handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1720, CVE-2009-1721)

It was discovered that OpenEXR did not properly handle certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-1722).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.8.  Mac OS X 10.5.8 contains security fixes for the following products : 

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launched
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.8. 

Mac OS X 10.5.8 contains security fixes for the following products :

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launchd
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-003 applied.

This security update contains fixes for the following products :

  - bzip2
  - ColorSync
  - ImageIO
  - Login Window

Multiple vulnerabilities has been found and corrected in OpenEXR :

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information (CVE-2009-1720).

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer (CVE-2009-1721).

This update provides fixes for these vulnerabilities.

- Wed Jul 29 2009 Rex Dieter <rdieter at     fedoraproject.org> 1.6.1-8

    - CVE-2009-1720 OpenEXR: Multiple integer overflows       (#513995)

    - CVE-2009-1721 OpenEXR: Invalid pointer free by image       decompression (#514003)

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.6.1-7

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.6.1-6

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Fri Dec 12 2008 Caolan McNamara <caolanm at       redhat.com> 1.6.1-5

    - rebuild to get provides pkgconfig(OpenEXR)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Jul 29 2009 Rex Dieter <rdieter at     fedoraproject.org> 1.6.1-8

    - CVE-2009-1720 OpenEXR: Multiple integer overflows       (#513995)

    - CVE-2009-1721 OpenEXR: Invalid pointer free by image       decompression (#514003)

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.6.1-7

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71259	GLSA-201312-07 : OpenEXR: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
44707	Debian DSA-1842-1 : openexr - several vulnerabilities	Nessus	Debian Local Security Checks	high
43075	Mandriva Linux Security Advisory : OpenEXR (MDVSA-2009:191-1)	Nessus	Mandriva Local Security Checks	high
41987	openSUSE 10 Security Update : OpenEXR (OpenEXR-6393)	Nessus	SuSE Local Security Checks	high
41472	SuSE 10 Security Update : OpenEXR (ZYPP Patch Number 6392)	Nessus	SuSE Local Security Checks	high
41360	SuSE 11 Security Update : OpenEXR (SAT Patch Number 1155)	Nessus	SuSE Local Security Checks	high
40982	Ubuntu 8.04 LTS / 8.10 / 9.04 : openexr vulnerabilities (USN-831-1)	Nessus	Ubuntu Local Security Checks	high
40845	openSUSE Security Update : OpenEXR (OpenEXR-1157)	Nessus	SuSE Local Security Checks	high
40841	openSUSE Security Update : OpenEXR (OpenEXR-1157)	Nessus	SuSE Local Security Checks	high
5122	Mac OS X 10.5 < 10.5.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
40502	Mac OS X 10.5.x < 10.5.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
40501	Mac OS X Multiple Vulnerabilities (Security Update 2009-003)	Nessus	MacOS X Local Security Checks	critical
40465	Mandriva Linux Security Advisory : OpenEXR (MDVSA-2009:190)	Nessus	Mandriva Local Security Checks	high
40453	Fedora 10 : OpenEXR-1.6.1-8.fc10 (2009-8136)	Nessus	Fedora Local Security Checks	high
40452	Fedora 11 : OpenEXR-1.6.1-8.fc11 (2009-8132)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-1720

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

critical

critical

high

high

high