Multiple security issues were found in the OpenEXR image library, which could result in denial of service and potentially the execution of arbitrary code when processing malformed EXR image files.

Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)

Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2018-18444)

Samuel Gross discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2020-11758, CVE-2020-11759, CVE-2020-11760, CVE-2020-11761, CVE-2020-11762, CVE-2020-11763, CVE-2020-11764)

It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service.
(CVE-2020-11765).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer (CVE-2021-23169)

  - OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

  - In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the     application to crash. (CVE-2017-9110)

  - In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could     cause the application to crash or execute arbitrary code. (CVE-2017-9111)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the     application to crash. (CVE-2017-9112)

  - In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could     cause the application to crash or execute arbitrary code. (CVE-2017-9113)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the     application to crash. (CVE-2017-9114)

  - In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the     application to crash or execute arbitrary code. (CVE-2017-9115)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the     application to crash. (CVE-2017-9116)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in     ImfOptimizedPixelReading.h. (CVE-2020-11758)

  - An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in     CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write     to an out-of-bounds pointer. (CVE-2020-11759)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression     in rleUncompress in ImfRle.cpp. (CVE-2020-11760)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman     uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. (CVE-2020-11761)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in     DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
    (CVE-2020-11762)

  - An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as     demonstrated by ImfTileOffsets.cpp. (CVE-2020-11763)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in     ImfMisc.cpp. (CVE-2020-11764)

  - An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read     function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read. (CVE-2020-11765)

  - A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in     chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted     EXR file. (CVE-2020-16587)

  - A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in     makePreview.cpp that can cause a denial of service via a crafted EXR file. (CVE-2020-16588)

  - A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in     ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file. (CVE-2020-16589)

  - A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker,     that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL     pointer dereference. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20296)

  - A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to     be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-20298)

  - A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no     actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to     system availability. (CVE-2021-20299)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a     crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The     highest threat from this vulnerability is to system availability. (CVE-2021-20302)

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
    (CVE-2021-23215)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This     is a different flaw from CVE-2021-23215. (CVE-2021-26260)

  - An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An     attacker could use this flaw to crash an application compiled with OpenEXR. (CVE-2021-26945)

  - There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR     could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application     availability. (CVE-2021-3474)

  - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be     processed by OpenEXR could cause an integer overflow, potentially leading to problems with application     availability. (CVE-2021-3475)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow,     subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application     availability. (CVE-2021-3477)

  - There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker     able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The     greatest impact of this flaw is to system availability. (CVE-2021-3478)

  - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is     able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory,     resulting in an impact to system availability. (CVE-2021-3479)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

  - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 -     chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the     divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition     which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Multiple security issues were found in the OpenEXR image library, which could result in denial of service and potentially the execution of arbitrary code when processing malformed EXR image files.

For Debian 9 stretch, these problems have been fixed in version 2.2.0-11+deb9u1.

We recommend that you upgrade your openexr packages.

For the detailed security status of openexr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openexr

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openexr provides the following fix :

Security issues fixed :

CVE-2020-11765: Fixed an off-by-one error in use of the ImfXdr.h read function by DwaCompressor:Classifier:Classifier (bsc#1169575).

CVE-2020-11764: Fixed an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574).

CVE-2020-11763: Fixed an out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp (bsc#1169576).

CVE-2020-11762: Fixed an out-of-bounds read and write in DwaCompressor:uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case (bsc#1169549).

CVE-2020-11761: Fixed an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder:refill in ImfFastHuf.cpp (bsc#1169578).

CVE-2020-11760: Fixed an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp (bsc#1169580).

CVE-2020-11758: Fixed an out-of-bounds read in ImfOptimizedPixelReading.h (bsc#1169573).

Non-security issue fixed :

Enable tests when building the package on x86_64. (bsc#1146648)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openexr provides the following fix :

Security issues fixed :

CVE-2020-11764: Fixed an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574).

CVE-2020-11763: Fixed an out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp (bsc#1169576).

CVE-2020-11758: Fixed an out-of-bounds read in ImfOptimizedPixelReading.h (bsc#1169573).

CVE-2020-11760: Fixed an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp (bsc#1169580).

Non-security issue fixed :

Enable tests when building the package on x86_64. (bsc#1146648)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-004, 10.14.x prior to 10.14.6 Security Update 2020-004, or 10.15.x prior to 10.15.6. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious     access point, or an adjacent user, to determine if a connected user is using a VPN, make positive     inferences about the websites they are visiting, and determine the correct sequence and acknowledgement     numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that     is needed for an attacker to hijack active connections inside the VPN tunnel. (CVE-2019-14899)

  - cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote     denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an     off-by-one error in _sasl_add_string in common.c in cyrus-sasl. (CVE-2019-19906)

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

  - rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the     synchronization path. (CVE-2014-9512)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-27 (OpenEXR: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenEXR. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for openexr provides the following fix :

Security issues fixed :

  - CVE-2020-11765: Fixed an off-by-one error in use of the     ImfXdr.h read function by     DwaCompressor:Classifier:Classifier (bsc#1169575).

  - CVE-2020-11764: Fixed an out-of-bounds write in     copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574).

  - CVE-2020-11763: Fixed an out-of-bounds read and write,     as demonstrated by ImfTileOffsets.cpp (bsc#1169576).

  - CVE-2020-11762: Fixed an out-of-bounds read and write in     DwaCompressor:uncompress in ImfDwaCompressor.cpp when     handling the UNKNOWN compression case (bsc#1169549).

  - CVE-2020-11761: Fixed an out-of-bounds read during     Huffman uncompression, as demonstrated by     FastHufDecoder:refill in ImfFastHuf.cpp (bsc#1169578).

  - CVE-2020-11760: Fixed an out-of-bounds read during RLE     uncompression in rleUncompress in ImfRle.cpp     (bsc#1169580).

  - CVE-2020-11758: Fixed an out-of-bounds read in     ImfOptimizedPixelReading.h (bsc#1169573).

Non-security issue fixed :

  - Enable tests when building the package on x86_64.
    (bsc#1146648)

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in     ImfOptimizedPixelReading.h. (CVE-2020-11758)

  - An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in     CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write     to an out-of-bounds pointer. (CVE-2020-11759)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression     in rleUncompress in ImfRle.cpp. (CVE-2020-11760)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman     uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. (CVE-2020-11761)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in     DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
    (CVE-2020-11762)

  - An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as     demonstrated by ImfTileOffsets.cpp. (CVE-2020-11763)

  - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in     ImfMisc.cpp. (CVE-2020-11764)

  - An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read     function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read. (CVE-2020-11765)

  - An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in     DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp. (CVE-2020-15305)

  - An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer     overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp. (CVE-2020-15306)

  - A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker,     that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL     pointer dereference. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20296)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
    (CVE-2021-23215)

  - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in     versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This     is a different flaw from CVE-2021-23215. (CVE-2021-26260)

  - There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR     could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application     availability. (CVE-2021-3474)

  - There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be     processed by OpenEXR could cause an integer overflow, potentially leading to problems with application     availability. (CVE-2021-3475)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow,     subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application     availability. (CVE-2021-3477)

  - There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker     able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The     greatest impact of this flaw is to system availability. (CVE-2021-3478)

  - There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is     able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory,     resulting in an impact to system availability. (CVE-2021-3479)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
140061	Debian DSA-4755-1 : openexr - security update	Nessus	Debian Local Security Checks	8/31/2020	2/22/2024	high
136028	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenEXR vulnerabilities (USN-4339-1)	Nessus	Ubuntu Local Security Checks	4/28/2020	10/20/2023	high
196105	RHEL 6 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
140057	Debian DLA-2358-1 : openexr security update	Nessus	Debian Local Security Checks	8/31/2020	2/22/2024	high
136787	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2020:1293-1)	Nessus	SuSE Local Security Checks	5/22/2020	3/12/2024	medium
136786	SUSE SLES12 Security Update : openexr (SUSE-SU-2020:1292-1)	Nessus	SuSE Local Security Checks	5/22/2020	3/12/2024	medium
141100	macOS 10.15.x < 10.15.6 / 10.14.x < 10.14.6 Security Update 2020-004 / 10.13.x < 10.13.6 Security Update 2020-004	Nessus	MacOS X Local Security Checks	10/1/2020	11/21/2022	critical
157033	GLSA-202107-27 : OpenEXR: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/16/2024	medium
136880	openSUSE Security Update : openexr (openSUSE-2020-682)	Nessus	SuSE Local Security Checks	5/26/2020	3/8/2024	medium
165850	EulerOS 2.0 SP8 : OpenEXR (EulerOS-SA-2022-2475)	Nessus	Huawei Local Security Checks	10/9/2022	10/10/2023	medium

Detections

Analytics

Plugins Search

high

high

critical

high

medium

medium

critical

medium

medium

medium