SUSE update for openexr



Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2021-20296
CVE-2021-23215
CVE-2021-26260
CVE-2021-3477
CVE-2021-3479
CWE-ID CWE-476
CWE-190
CWE-125
CWE-400
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Linux Enterprise Module for Desktop Applications
Operating systems & Components / Operating system

openexr-devel
Operating systems & Components / Operating system package or component

openexr-debugsource
Operating systems & Components / Operating system package or component

openexr-debuginfo
Operating systems & Components / Operating system package or component

libIlmImfUtil-2_2-23-debuginfo
Operating systems & Components / Operating system package or component

libIlmImfUtil-2_2-23
Operating systems & Components / Operating system package or component

libIlmImf-2_2-23-debuginfo
Operating systems & Components / Operating system package or component

libIlmImf-2_2-23
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU51935

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-20296

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Dwa decompression functionality. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package openexr to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3

openexr-devel: before 2.2.1-3.27.1

openexr-debugsource: before 2.2.1-3.27.1

openexr-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23: before 2.2.1-3.27.1

libIlmImf-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImf-2_2-23: before 2.2.1-3.27.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU54397

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-23215

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the DwaCompressor of OpenEXR. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service (DoS) attack.

Mitigation

Update the affected package openexr to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3

openexr-devel: before 2.2.1-3.27.1

openexr-debugsource: before 2.2.1-3.27.1

openexr-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23: before 2.2.1-3.27.1

libIlmImf-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImf-2_2-23: before 2.2.1-3.27.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU54402

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-26260

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow in the DwaCompressor of OpenEXR. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service attack.

Mitigation

Update the affected package openexr to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3

openexr-devel: before 2.2.1-3.27.1

openexr-debugsource: before 2.2.1-3.27.1

openexr-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23: before 2.2.1-3.27.1

libIlmImf-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImf-2_2-23: before 2.2.1-3.27.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU51932

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3477

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the deep tile sample size calculations. A remote attacker can create a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package openexr to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3

openexr-devel: before 2.2.1-3.27.1

openexr-debugsource: before 2.2.1-3.27.1

openexr-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23: before 2.2.1-3.27.1

libIlmImf-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImf-2_2-23: before 2.2.1-3.27.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU51934

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3479

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the Scanline API functionality. A remote attacker can use a specially crafted file, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package openexr to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3

openexr-devel: before 2.2.1-3.27.1

openexr-debugsource: before 2.2.1-3.27.1

openexr-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImfUtil-2_2-23: before 2.2.1-3.27.1

libIlmImf-2_2-23-debuginfo: before 2.2.1-3.27.1

libIlmImf-2_2-23: before 2.2.1-3.27.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###