This update for openexr fixes the following issues :

Security issues fixed :

  - CVE-2020-16587: Fixed a heap-based buffer overflow in     chunkOffsetReconstruction in ImfMultiPartInputFile.cpp     (bsc#1179879).

  - CVE-2020-16588: Fixed a NULL pointer deference in     generatePreview (bsc#1179879).

  - CVE-2020-16589: Fixed a heap-based buffer overflow in     writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).

This update was imported from the SUSE:SLE-15:Update update project.

Two issues were discovered in openexr, a set of tools to manipulate OpenEXR image files, often in the computer-graphics industry for visual effects and animation.

For Debian 9 'Stretch', these problems has been fixed in version 2.2.0-11+deb9u2.

We recommend that you upgrade your openexr packages.

For the detailed security status of openexr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openexr

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openexr fixes the following issues :

Security issues fixed :

CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).

CVE-2020-16588: Fixed a NULL pointer deference in generatePreview (bsc#1179879).

CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer (CVE-2021-23169)

  - A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in     chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted     EXR file. (CVE-2020-16587)

  - A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in     ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file. (CVE-2020-16589)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3236 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3236-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     December 12, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openexr     Version        : 2.2.1-4.1+deb10u2     CVE ID         : CVE-2020-16587 CVE-2020-16588 CVE-2020-16589 CVE-2021-3474                      CVE-2021-3475 CVE-2021-3476 CVE-2021-3477 CVE-2021-3478                      CVE-2021-3479 CVE-2021-3598 CVE-2021-3605 CVE-2021-3933                      CVE-2021-3941 CVE-2021-20296 CVE-2021-20298 CVE-2021-20299                      CVE-2021-20300 CVE-2021-20302 CVE-2021-20303 CVE-2021-23215                      CVE-2021-26260 CVE-2021-45942     Debian Bug     : 986796 992703 990450 990899 1014828

    Multiple security vulnerabilities have been found in OpenEXR, command-line     tools and a library for the OpenEXR image format. Buffer overflows or     out-of-bound reads could lead to a denial of service (application crash) if     a malformed image file is processed.

    For Debian 10 buster, these problems have been fixed in version     2.2.1-4.1+deb10u2.

    We recommend that you upgrade your openexr packages.

    For the detailed security status of openexr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openexr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4676-1 advisory.

    It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were     tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
145347	openSUSE Security Update : openexr (openSUSE-2020-2349)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	medium
144152	Debian DLA-2491-1 : openexr security update	Nessus	Debian Local Security Checks	12/14/2020	2/2/2024	medium
144596	SUSE SLES12 Security Update : openexr (SUSE-SU-2020:3931-1)	Nessus	SuSE Local Security Checks	12/24/2020	1/31/2024	medium
202483	RHEL 8 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	7/16/2024	7/16/2024	high
145285	openSUSE Security Update : openexr (openSUSE-2020-2351)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	medium
168916	Debian dla-3236 : libopenexr-dev - security update	Nessus	Debian Local Security Checks	12/19/2022	1/22/2025	medium
144608	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2020:3934-1)	Nessus	SuSE Local Security Checks	12/28/2020	1/31/2024	medium
144746	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenEXR vulnerabilities (USN-4676-1)	Nessus	Ubuntu Local Security Checks	1/5/2021	8/27/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

medium

medium

medium