A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.
    An attacker could use this flaw to execute arbitrary code with the permissions of the user running the     application compiled against OpenEXR. (CVE-2021-23169)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker
    who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds
    read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.
    An attacker could use this flaw to execute arbitrary code with the permissions of the user running the
    application compiled against OpenEXR. (CVE-2021-23169)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in
    versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
    (CVE-2021-23215)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in
    versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This
    is a different flaw from CVE-2021-23215. (CVE-2021-26260)

  - An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An
    attacker could use this flaw to crash an application compiled with OpenEXR. (CVE-2021-26945)

The remote host is affected by the vulnerability described in GLSA-202210-31 (OpenEXR: Multiple Vulnerabilities)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.
    An attacker could use this flaw to execute arbitrary code with the permissions of the user running the     application compiled against OpenEXR. (CVE-2021-23169)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

  - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 -     chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the     divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition     which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

  - OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called     from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE:
    db217f2 may be inapplicable. (CVE-2021-45942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
223632	Linux Distros Unpatched Vulnerability : CVE-2021-23169	Nessus	Misc.	Local	high
405915	Alpine: multiple openexr packages: security update to 3.1.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405915	Alpine: multiple openexr packages: security update to 3.1.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400162	Alpine: multiple openexr packages: security update to 2.5.7-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400162	Alpine: multiple openexr packages: security update to 2.5.7-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
166712	GLSA-202210-31 : OpenEXR: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2021-23169

high

Tenable Plugins

high

high

high

high

high

high