Vulnerabilities (CVE)

Filtered by vendor Openexr Subscribe
Total 49 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-14988 1 Openexr 1 Openexr 2024-08-05 4.3 MEDIUM 5.5 MEDIUM
Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid
CVE-2023-5841 1 Openexr 1 Openexr 2024-02-28 N/A 9.1 CRITICAL
Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.
CVE-2021-20298 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 N/A 7.5 HIGH
A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.
CVE-2021-20304 1 Openexr 1 Openexr 2024-02-28 N/A 7.5 HIGH
A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.
CVE-2021-20303 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 5.8 MEDIUM 6.1 MEDIUM
A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
CVE-2021-20299 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 4.3 MEDIUM 7.5 HIGH
A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVE-2021-3941 4 Debian, Fedoraproject, Openexr and 1 more 4 Debian Linux, Fedora, Openexr and 1 more 2024-02-28 2.1 LOW 6.5 MEDIUM
In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.
CVE-2021-3933 3 Debian, Fedoraproject, Openexr 3 Debian Linux, Fedora, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
CVE-2021-20302 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 7.1 HIGH 5.5 MEDIUM
A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
CVE-2021-20300 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 7.1 HIGH 5.5 MEDIUM
A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.
CVE-2021-45942 3 Debian, Fedoraproject, Openexr 3 Debian Linux, Fedora, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
CVE-2021-26945 1 Openexr 1 Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
CVE-2021-3475 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability.
CVE-2021-26260 3 Debian, Fedoraproject, Openexr 3 Debian Linux, Fedora, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
CVE-2021-3474 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability.
CVE-2021-3479 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.
CVE-2021-3605 3 Debian, Openexr, Redhat 3 Debian Linux, Openexr, Enterprise Linux 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
CVE-2021-20296 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
CVE-2021-3478 2 Debian, Openexr 2 Debian Linux, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability.
CVE-2021-23215 3 Debian, Fedoraproject, Openexr 3 Debian Linux, Fedora, Openexr 2024-02-28 4.3 MEDIUM 5.5 MEDIUM
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.