CVE-2021-3933medium
Description
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
References
https://bugzilla.redhat.com/show_bug.cgi?id=2019783
https://security.gentoo.org/glsa/202210-31
https://www.debian.org/security/2022/dsa-5299
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
Details
Source: MITRE
Published: 2022-03-25
Updated: 2023-02-03
Type: CWE-190
Risk Information
CVSS v2
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 5.5
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 1.8
Severity: MEDIUM