Detections
Analytics

Debian DSA-5299-1 : openexr - security update

medium Nessus Plugin ID 168623

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5299 advisory.

 - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
 (CVE-2021-23215)

 - An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215. (CVE-2021-26260)

 - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

 - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability. (CVE-2021-3605)

 - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
 This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths. (CVE-2021-3933)

 - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

 - OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE:
 db217f2 may be inapplicable. (CVE-2021-45942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the openexr packages.

For the stable distribution (bullseye), these problems have been fixed in version 2.5.4-2+deb11u1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992703

https://security-tracker.debian.org/tracker/source-package/openexr

https://www.debian.org/security/2022/dsa-5299

https://security-tracker.debian.org/tracker/CVE-2021-23215

https://security-tracker.debian.org/tracker/CVE-2021-26260

https://security-tracker.debian.org/tracker/CVE-2021-3598

https://security-tracker.debian.org/tracker/CVE-2021-3605

https://security-tracker.debian.org/tracker/CVE-2021-3933

https://security-tracker.debian.org/tracker/CVE-2021-3941

https://security-tracker.debian.org/tracker/CVE-2021-45942

https://packages.debian.org/source/bullseye/openexr

Plugin Details

Severity: Medium

ID: 168623

File Name: debian_DSA-5299.nasl

Version: 1.3

Type: local

Agent: unix

Published: 12/11/2022

Updated: 9/15/2023

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-45942

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-3941

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libopenexr-dev, p-cpe:/a:debian:debian_linux:libopenexr25, p-cpe:/a:debian:debian_linux:openexr, p-cpe:/a:debian:debian_linux:openexr-doc

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/10/2022

Vulnerability Publication Date: 6/8/2021

Reference Information

CVE: CVE-2021-23215, CVE-2021-26260, CVE-2021-3598, CVE-2021-3605, CVE-2021-3933, CVE-2021-3941, CVE-2021-45942