A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3236 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3236-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     December 12, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openexr     Version        : 2.2.1-4.1+deb10u2     CVE ID         : CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 CVE-2021-3474                      CVE-2021-3475 CVE-2021-3476 CVE-2021-3477 CVE-2021-3478                      CVE-2021-3479 CVE-2021-3598 CVE-2021-3605 CVE-2021-3933                      CVE-2021-3941 CVE-2021-20296 CVE-2021-20298 CVE-2021-20299                      CVE-2021-20300 CVE-2021-20302 CVE-2021-20303 CVE-2021-23215                      CVE-2021-26260 CVE-2021-45942     Debian Bug     : 986796 992703 990450 990899 1014828

    Multiple security vulnerabilities have been found in OpenEXR, command-line     tools and a library for the OpenEXR image format. Buffer overflows or     out-of-bound reads could lead to a denial of service (application crash) if     a malformed image file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.2.1-4.1+deb10u2.

    We recommend that you upgrade your openexr packages.

    For the detailed security status of openexr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openexr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14846-1 advisory.

  - A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to     be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-20298)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 -     chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the     divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition     which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2913-1 advisory.

  - A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to     be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-20298)

  - A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no     actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to     system availability. (CVE-2021-20299)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a     crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The     highest threat from this vulnerability is to system availability. (CVE-2021-20302)

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1198-1 advisory.

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no     actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to     system availability. (CVE-2021-20299)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a     crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The     highest threat from this vulnerability is to system availability. (CVE-2021-20302)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2793-1 advisory.

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

  - A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no     actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to     system availability. (CVE-2021-20299)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a     crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The     highest threat from this vulnerability is to system availability. (CVE-2021-20302)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2793-1 advisory.

  - A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to     be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-20298)

  - A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no     actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to     system availability. (CVE-2021-20299)

  - A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows     an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow.
    The highest threat from this vulnerability is to system availability. (CVE-2021-20300)

  - A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a     crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The     highest threat from this vulnerability is to system availability. (CVE-2021-20302)

  - A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit     a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds     write on the heap. The greatest impact of this flaw is to application availability, with some potential     impact to data integrity as well. (CVE-2021-20303)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker     who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting     application availability. (CVE-2021-3476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2732 advisory.

    Several vulnerabilities were discovered in OpenEXR, a library and tools for the OpenEXR high dynamic-range     (HDR) image format. An attacker could cause a denial of service (DoS) through application crash, and     possibly execute code. For Debian 9 stretch, these problems have been fixed in version 2.2.0-11+deb9u4. We     recommend that you upgrade your openexr packages. For the detailed security status of openexr please refer     to its security tracker page at: https://security-tracker.debian.org/tracker/openexr Further information     about Debian LTS security advisories, how to apply these updates to your system and frequently asked     questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
168916	Debian dla-3236 : libopenexr-dev - security update	Nessus	Debian Local Security Checks	medium
155801	SUSE SLES11 Security Update : OpenEXR (SUSE-SU-2021:14846-1)	Nessus	SuSE Local Security Checks	medium
153014	SUSE SLED12 / SLES12 Security Update : openexr (SUSE-SU-2021:2913-1)	Nessus	SuSE Local Security Checks	medium
152835	openSUSE 15 Security Update : openexr (openSUSE-SU-2021:1198-1)	Nessus	SuSE Local Security Checks	medium
152725	openSUSE 15 Security Update : openexr (openSUSE-SU-2021:2793-1)	Nessus	SuSE Local Security Checks	medium
152711	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2021:2793-1)	Nessus	SuSE Local Security Checks	medium
152223	Debian DLA-2732-1 : openexr - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-20300

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium