An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-openexr | Aug 22, 2024 | Apr 14, 2020 | |
| Apple Itunes | apple-itunes-upgrade-latest | Sep 9, 2020 | Apr 14, 2020 | |
| Apple Osx Imageio | apple-osx-security-update-2020-004-high-sierraapple-osx-security-update-2020-004-mojaveapple-osx-upgrade-latest | Sep 9, 2020 | Apr 14, 2020 | |
| Debian | debian-upgrade-openexr | Aug 31, 2020 | Apr 14, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-openexr | Jul 12, 2021 | Apr 14, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-openexr-libs | Oct 11, 2022 | Apr 14, 2020 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Apr 14, 2020 |
| Suse | — | suse-upgrade-libilmimf-2_2-23suse-upgrade-libilmimf-2_2-23-32bitsuse-upgrade-libilmimfutil-2_2-23suse-upgrade-libilmimfutil-2_2-23-32bitsuse-upgrade-openexrsuse-upgrade-openexr-develsuse-upgrade-openexr-doc | May 23, 2020 | Apr 14, 2020 |
| Ubuntu | ubuntu-upgrade-libopenexr22ubuntu-upgrade-libopenexr23ubuntu-upgrade-libopenexr24ubuntu-upgrade-openexr | Apr 28, 2020 | Apr 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub