Multiple vulnerabilities in OpenEXR

Published: 2021-06-17

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	N/A
CWE-ID	CWE-122 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	OpenEXR Client/Desktop applications / Multimedia software
Vendor	OpenEXR

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU54181

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Imf_2_5::copyIntoFrameBuffer() function. A remote attacker can pass specially crafted EXR file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenEXR: 2.0.0 - 2.5.6

External links

http://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.7
http://github.com/AcademySoftwareFoundation/openexr/commit/6006b2e34fc6457e96d3fb422479b02c19843a1a
http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28051
http://github.com/AcademySoftwareFoundation/openexr/pull/872

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU54182

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]