There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5620-1 advisory.

    It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were     tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code. These issues only affected Ubuntu 20.04 ESM. (CVE-2021-3598,     CVE-2021-3605, CVE-2021-20296, CVE-2021-23215, CVE-2021-26260)

    It was discovered that OpenEXR incorrectly handled certain EXR image files. An attacker could possibly use     this issue to cause a crash or execute arbitrary code. (CVE-2021-3933)

    It was discovered that OpenEXR incorrectly handled certain EXR image files. An attacker could possibly use     this issue to cause a crash. (CVE-2021-3941)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2078 advisory.

    A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to     be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-20298)

    A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

    A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

    There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be     processed by OpenEXR could cause an integer overflow, potentially leading to problems with application     availability. (CVE-2021-3475)

    There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3236 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3236-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     December 12, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openexr     Version        : 2.2.1-4.1+deb10u2     CVE ID         : CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 CVE-2021-3474                      CVE-2021-3475 CVE-2021-3476 CVE-2021-3477 CVE-2021-3478                      CVE-2021-3479 CVE-2021-3598 CVE-2021-3605 CVE-2021-3933                      CVE-2021-3941 CVE-2021-20296 CVE-2021-20298 CVE-2021-20299                      CVE-2021-20300 CVE-2021-20302 CVE-2021-20303 CVE-2021-23215                      CVE-2021-26260 CVE-2021-45942     Debian Bug     : 986796 992703 990450 990899 1014828

    Multiple security vulnerabilities have been found in OpenEXR, command-line     tools and a library for the OpenEXR image format. Buffer overflows or     out-of-bound reads could lead to a denial of service (application crash) if     a malformed image file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.2.1-4.1+deb10u2.

    We recommend that you upgrade your openexr packages.

    For the detailed security status of openexr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openexr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5299 advisory.

    Multiple security vulnerabilities have been found in OpenEXR, command-line tools and a library for the     OpenEXR image format. Buffer overflows or out-of-bound reads could lead to a denial of service     (application crash) if a malformed image file is processed. For the stable distribution (bullseye), these     problems have been fixed in version 2.5.4-2+deb11u1. We recommend that you upgrade your openexr packages.
    For the detailed security status of openexr please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/openexr

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-31 (OpenEXR: Multiple Vulnerabilities)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.
    An attacker could use this flaw to execute arbitrary code with the permissions of the user running the     application compiled against OpenEXR. (CVE-2021-23169)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

  - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 -     chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the     divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition     which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

  - OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called     from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE:
    db217f2 may be inapplicable. (CVE-2021-45942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in     ImfOptimizedPixelReading.h. (CVE-2020-11758)

  - An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in     CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write     to an out-of-bounds pointer. (CVE-2020-11759)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression     in rleUncompress in ImfRle.cpp. (CVE-2020-11760)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman     uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. (CVE-2020-11761)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in     DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
    (CVE-2020-11762)

  - An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as     demonstrated by ImfTileOffsets.cpp. (CVE-2020-11763)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in     ImfMisc.cpp. (CVE-2020-11764)

  - An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read     function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read. (CVE-2020-11765)

  - An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in     DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp. (CVE-2020-15305)

  - An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer     overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp. (CVE-2020-15306)

  - A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker,     that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL     pointer dereference. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20296)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
    (CVE-2021-23215)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This     is a different flaw from CVE-2021-23215. (CVE-2021-26260)

  - There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR     could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application     availability. (CVE-2021-3474)

  - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be     processed by OpenEXR could cause an integer overflow, potentially leading to problems with application     availability. (CVE-2021-3475)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow,     subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application     availability. (CVE-2021-3477)

  - There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker     able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The     greatest impact of this flaw is to system availability. (CVE-2021-3478)

  - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is     able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory,     resulting in an impact to system availability. (CVE-2021-3479)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be     processed by OpenEXR could cause an integer overflow, potentially leading to problems with application     availability. (CVE-2021-3475)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2732 advisory.

    Several vulnerabilities were discovered in OpenEXR, a library and tools for the OpenEXR high dynamic-range     (HDR) image format. An attacker could cause a denial of service (DoS) through application crash, and     possibly execute code. For Debian 9 stretch, these problems have been fixed in version 2.2.0-11+deb9u4. We     recommend that you upgrade your openexr packages. For the detailed security status of openexr please refer     to its security tracker page at: https://security-tracker.debian.org/tracker/openexr Further information     about Debian LTS security advisories, how to apply these updates to your system and frequently asked     questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2158-1 advisory.

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2158-1 advisory.

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2159-1 advisory.

  - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is     able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory,     resulting in an impact to system availability. (CVE-2021-3479)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 / SLES_SAP11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14757-1 advisory.

  - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is     able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory,     resulting in an impact to system availability. (CVE-2021-3479)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0925-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4996-2 advisory.

    USN-4996-1 fixed several vulnerabilities in OpenEXR. This update provides the corresponding update for     Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4996-1 advisory.

    It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were     tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224107	Linux Distros Unpatched Vulnerability : CVE-2021-3605	Nessus	Misc.	medium
183721	Ubuntu 20.04 ESM / 22.04 ESM : OpenEXR vulnerabilities (USN-5620-1)	Nessus	Ubuntu Local Security Checks	medium
176921	Amazon Linux 2 : OpenEXR (ALAS-2023-2078)	Nessus	Amazon Linux Local Security Checks	medium
168916	Debian dla-3236 : libopenexr-dev - security update	Nessus	Debian Local Security Checks	medium
168623	Debian DSA-5299-1 : openexr - security update	Nessus	Debian Local Security Checks	medium
166712	GLSA-202210-31 : OpenEXR: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
165850	EulerOS 2.0 SP8 : OpenEXR (EulerOS-SA-2022-2475)	Nessus	Huawei Local Security Checks	medium
161546	EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2022-1750)	Nessus	Huawei Local Security Checks	medium
160131	EulerOS 2.0 SP5 : OpenEXR (EulerOS-SA-2022-1544)	Nessus	Huawei Local Security Checks	medium
152223	Debian DLA-2732-1 : openexr - LTS security update	Nessus	Debian Local Security Checks	medium
151740	openSUSE 15 Security Update : openexr (openSUSE-SU-2021:2158-1)	Nessus	SuSE Local Security Checks	medium
151107	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2021:2158-1)	Nessus	SuSE Local Security Checks	medium
151101	SUSE SLED12 / SLES12 Security Update : openexr (SUSE-SU-2021:2159-1)	Nessus	SuSE Local Security Checks	medium
151099	SUSE SLES11 Security Update : OpenEXR (SUSE-SU-2021:14757-1)	Nessus	SuSE Local Security Checks	medium
151059	openSUSE 15 Security Update : openexr (openSUSE-SU-2021:0925-1)	Nessus	SuSE Local Security Checks	medium
150948	Ubuntu 16.04 ESM : OpenEXR vulnerabilities (USN-4996-2)	Nessus	Ubuntu Local Security Checks	medium
150947	Ubuntu 18.04 LTS : OpenEXR vulnerabilities (USN-4996-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-3605

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium