In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Out-of-bounds write in the = operator function (CVE-2017-9115)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Out-of-bounds write in the = operator function (CVE-2017-9115)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in OpenEXR before 2.4.1. There     is an std::vector out-of-bounds read and write, as     demonstrated by ImfTileOffsets.cpp.(CVE-2020-11763)

  - An issue was discovered in OpenEXR before 2.4.1. There     is an out-of-bounds write in copyIntoFrameBuffer in     ImfMisc.cpp.(CVE-2020-11764)

  - In OpenEXR 2.2.0, an invalid write of size 8 in the     storeSSE function in ImfOptimizedPixelReading.h could     cause the application to crash or execute arbitrary     code.(CVE-2017-9111)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     getBits function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9112)

  - In OpenEXR 2.2.0, an invalid write of size 1 in the     bufferedReadPixels function in ImfInputFile.cpp could     cause the application to crash or execute arbitrary     code.(CVE-2017-9113)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     refill function in ImfFastHuf.cpp could cause the     application to crash.(CVE-2017-9114)

  - In OpenEXR 2.2.0, an invalid write of size 2 in the =     operator function in half.h could cause the application     to crash or execute arbitrary code.(CVE-2017-9115)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     uncompress function in ImfZip.cpp could cause the     application to crash.(CVE-2017-9116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - OpenEXR is a high dynamic-range (HDR) image file format     developed by Industrial Light & Magic for use in     computer imaging applications. This package contains     libraries and sample applications for handling the     format.Security Fix(es):In OpenEXR 2.2.0, a crafted     image causes a heap-based buffer over-read in the     hufDecode function in IlmImf/ImfHuf.cpp during     exrmaketiled execution it may result in denial of     service or possibly unspecified other     impact.(CVE-2017-12596)In OpenEXR 2.2.0, an invalid     read of size 2 in the hufDecode function in ImfHuf.cpp     could cause the application to crash.(CVE-2017-9110)In     OpenEXR 2.2.0, an invalid write of size 8 in the     storeSSE function in ImfOptimizedPixelReading.h could     cause the application to crash or execute arbitrary     code.(CVE-2017-9111)In OpenEXR 2.2.0, an invalid read     of size 1 in the getBits function in ImfHuf.cpp could     cause the application to crash.(CVE-2017-9112)In     OpenEXR 2.2.0, an invalid write of size 1 in the     bufferedReadPixels function in ImfInputFile.cpp could     cause the application to crash or execute arbitrary     code.(CVE-2017-9113)In OpenEXR 2.2.0, an invalid read     of size 1 in the refill function in ImfFastHuf.cpp     could cause the application to crash.(CVE-2017-9114)In     OpenEXR 2.2.0, an invalid write of size 2 in the =     operator function in half.h could cause the application     to crash or execute arbitrary code.(CVE-2017-9115)In     OpenEXR 2.2.0, an invalid read of size 1 in the     uncompress function in ImfZip.cpp could cause the     application to crash.(CVE-2017-9116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in the OpenEXR image library, which could result in denial of service and potentially the execution of arbitrary code when processing malformed EXR image files.

For Debian 9 stretch, these problems have been fixed in version 2.2.0-11+deb9u1.

We recommend that you upgrade your openexr packages.

For the detailed security status of openexr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openexr

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - OpenEXR is a high dynamic-range (HDR) image file format     developed by Industrial Light & Magic for use in     computer imaging applications. This package contains     libraries and sample applications for handling the     format.Security Fix(es):In OpenEXR 2.2.0, an invalid     write of size 2 in the = operator function in half.h     could cause the application to crash or execute     arbitrary code.(CVE-2017-9115)In OpenEXR 2.2.0, an     invalid write of size 8 in the storeSSE function in     ImfOptimizedPixelReading.h could cause the application     to crash or execute arbitrary code.(CVE-2017-9111)In     OpenEXR 2.2.0, a crafted image causes a heap-based     buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution it may     result in denial of service or possibly unspecified     other impact.(CVE-2017-12596)In OpenEXR 2.2.0, an     invalid write of size 1 in the bufferedReadPixels     function in ImfInputFile.cpp could cause the     application to crash or execute arbitrary     code.(CVE-2017-9113)In OpenEXR 2.2.0, an invalid read     of size 1 in the uncompress function in ImfZip.cpp     could cause the application to crash.(CVE-2017-9116)In     OpenEXR 2.2.0, an invalid read of size 1 in the refill     function in ImfFastHuf.cpp could cause the application     to crash.(CVE-2017-9114)In OpenEXR 2.2.0, an invalid     read of size 1 in the getBits function in ImfHuf.cpp     could cause the application to crash.(CVE-2017-9112)In     OpenEXR 2.2.0, an invalid read of size 2 in the     hufDecode function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9110)Header::readfrom in     IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote     attackers to cause a denial of service (excessive     memory allocation) via a crafted file that is accessed     with the ImfOpenInputFile function in     IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and     multiple third parties believe that this vulnerability     isn't valid.(CVE-2017-14988)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR     2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted     file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The     maintainer and multiple third parties believe that this     vulnerability isn't valid.(CVE-2017-14988)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     getBits function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9112)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     refill function in ImfFastHuf.cpp could cause the     application to crash.(CVE-2017-9114)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     uncompress function in ImfZip.cpp could cause the     application to crash.(CVE-2017-9116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4148-1 advisory.

    It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were     tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-12596)

    Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user     were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-9110, CVE-2017-9112,     CVE-2017-9116)

    Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user     were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code. (CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)

    Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were     tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code. (CVE-2018-18444)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openexr fixes the following issues :

Security issue fixed :

CVE-2017-9111: Fixed an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h (bsc#1040109).

CVE-2017-9113: Fixed an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp (bsc#1040113).

CVE-2017-9115: Fixed an invalid write of size 2 in the = operator function inhalf.h (bsc#1040115).

CVE-2018-18444: Fixed Out-of-bounds write in makeMultiView.cpp (bsc#1113455).

CVE-2017-9112: Fixed invalid read of size 1 in the getBits function in ImfHuf.cpp (bsc#1040112).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following vulnerabilities: CVE-2017-9110 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113 CVE-2017-9114 CVE-2017-9115 CVE-2017-9116 CVE-2017-12596

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New openexr packages are available for Slackware 14.2 and -current to fix security issues.

Brandon Perry discovered that openexr, a high dynamic-range (HDR) image library, was affected by an integer overflow vulnerability and missing boundary checks that would allow a remote attacker to cause a denial of service (application crash) via specially crafted image files.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.1-6+deb7u1.

We recommend that you upgrade your openexr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brandon Perry reports :

[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).

- CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.

- CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.

- CVE-2017-9112 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.

- CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.

- CVE-2017-9114 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.

- CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.

- CVE-2017-9116 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.

ID	Name	Product	Family	Severity
199476	RHEL 7 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199422	RHEL 6 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196113	RHEL 7 : openexr (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196105	RHEL 6 : openexr (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
146642	EulerOS 2.0 SP2 : OpenEXR (EulerOS-SA-2021-1335)	Nessus	Huawei Local Security Checks	high
146115	EulerOS 2.0 SP5 : OpenEXR (EulerOS-SA-2021-1219)	Nessus	Huawei Local Security Checks	high
140057	Debian DLA-2358-1 : openexr security update	Nessus	Debian Local Security Checks	high
136862	EulerOS 2.0 SP8 : OpenEXR (EulerOS-SA-2020-1584)	Nessus	Huawei Local Security Checks	high
135545	EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2020-1416)	Nessus	Huawei Local Security Checks	medium
129712	Ubuntu 16.04 LTS / 18.04 LTS : OpenEXR vulnerabilities (USN-4148-1)	Nessus	Ubuntu Local Security Checks	high
127039	SUSE SLED12 / SLES12 Security Update : openexr (SUSE-SU-2019:1962-1)	Nessus	SuSE Local Security Checks	high
107040	Fedora 26 : mingw-OpenEXR (2018-f5d2f4ec0d)	Nessus	Fedora Local Security Checks	high
107034	Fedora 27 : mingw-OpenEXR (2018-b152c791cc)	Nessus	Fedora Local Security Checks	high
103570	Slackware 14.2 / current : openexr (SSA:2017-274-01)	Nessus	Slackware Local Security Checks	high
102891	Debian DLA-1083-1 : openexr security update	Nessus	Debian Local Security Checks	medium
100442	FreeBSD : OpenEXR -- multiple remote code execution and denial of service vulnerabilities (803879e9-4195-11e7-9b08-080027ef73ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-9112

medium

Tenable Plugins

high

high

high

critical

high

high

high

high

medium

high

high

high

high

high

medium

high