CVE-2021-3598

NameCVE-2021-3598
DescriptionThere's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2701-1
NVD severitylow
Debian Bugs990450

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openexr (PTS)stretch2.2.0-11vulnerable
stretch (security)2.2.0-11+deb9u4fixed
buster, buster (security)2.2.1-4.1+deb10u1vulnerable
bullseye, sid2.5.4-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openexrsourcestretch2.2.0-11+deb9u3DLA-2701-1
openexrsource(unstable)(unfixed)990450

Notes

[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
https://github.com/AcademySoftwareFoundation/openexr/issues/1033
https://github.com/AcademySoftwareFoundation/openexr/pull/1037
https://github.com/AcademySoftwareFoundation/openexr/commit/566f5241edd87445373885d5f7a904dc81e866c1 (master)
https://github.com/AcademySoftwareFoundation/openexr/commit/e2667ae1a3ff8a9fce730e61129868b326abb3f5 (2.5)
Introduced by https://github.com/AcademySoftwareFoundation/openexr/commit/9f011ae9ce9b1ca03521ff76e7659d34ee830344 (v2.0.0)

Search for package or bug name: Reporting problems