var-202004-0471
Vulnerability from variot
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. OpenEXR Exists in an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. A buffer error vulnerability exists in the 'FastHufDecoder::refill' function of the ImfFastHuf.cpp file in LIM OpenEXR versions prior to 2.4.1. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202107-27
https://security.gentoo.org/
Severity: Normal Title: OpenEXR: Multiple vulnerabilities Date: July 11, 2021 Bugs: #717474, #746794, #762862, #770229, #776808 ID: 202107-27
Synopsis
Multiple vulnerabilities have been found in OpenEXR, the worst of which could result in the arbitrary execution of code.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/openexr < 2.5.6 >= 2.5.6
Description
Multiple vulnerabilities have been discovered in OpenEXR. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All OpenEXR users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/openexr-2.5.6"
References
[ 1 ] CVE-2020-11758 https://nvd.nist.gov/vuln/detail/CVE-2020-11758 [ 2 ] CVE-2020-11759 https://nvd.nist.gov/vuln/detail/CVE-2020-11759 [ 3 ] CVE-2020-11760 https://nvd.nist.gov/vuln/detail/CVE-2020-11760 [ 4 ] CVE-2020-11761 https://nvd.nist.gov/vuln/detail/CVE-2020-11761 [ 5 ] CVE-2020-11762 https://nvd.nist.gov/vuln/detail/CVE-2020-11762 [ 6 ] CVE-2020-11763 https://nvd.nist.gov/vuln/detail/CVE-2020-11763 [ 7 ] CVE-2020-11764 https://nvd.nist.gov/vuln/detail/CVE-2020-11764 [ 8 ] CVE-2020-11765 https://nvd.nist.gov/vuln/detail/CVE-2020-11765 [ 9 ] CVE-2020-15304 https://nvd.nist.gov/vuln/detail/CVE-2020-15304 [ 10 ] CVE-2020-15305 https://nvd.nist.gov/vuln/detail/CVE-2020-15305 [ 11 ] CVE-2020-15306 https://nvd.nist.gov/vuln/detail/CVE-2020-15306 [ 12 ] CVE-2021-20296 https://nvd.nist.gov/vuln/detail/CVE-2021-20296 [ 13 ] CVE-2021-3474 https://nvd.nist.gov/vuln/detail/CVE-2021-3474 [ 14 ] CVE-2021-3475 https://nvd.nist.gov/vuln/detail/CVE-2021-3475 [ 15 ] CVE-2021-3476 https://nvd.nist.gov/vuln/detail/CVE-2021-3476 [ 16 ] CVE-2021-3477 https://nvd.nist.gov/vuln/detail/CVE-2021-3477 [ 17 ] CVE-2021-3478 https://nvd.nist.gov/vuln/detail/CVE-2021-3478 [ 18 ] CVE-2021-3479 https://nvd.nist.gov/vuln/detail/CVE-2021-3479
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202107-27
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: OpenEXR security update Advisory ID: RHSA-2020:4039-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4039 Issue date: 2020-09-29 CVE Names: CVE-2020-11761 CVE-2020-11763 CVE-2020-11764 ==================================================================== 1. Summary:
An update for OpenEXR is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light & Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format.
Security Fix(es):
-
OpenEXR: out-of-bounds read during Huffman uncompression (CVE-2020-11761)
-
OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp (CVE-2020-11763)
-
OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp (CVE-2020-11764)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: OpenEXR-1.7.1-8.el7.src.rpm
x86_64: OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-libs-1.7.1-8.el7.i686.rpm OpenEXR-libs-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: OpenEXR-1.7.1-8.el7.x86_64.rpm OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-devel-1.7.1-8.el7.i686.rpm OpenEXR-devel-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: OpenEXR-1.7.1-8.el7.src.rpm
x86_64: OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-libs-1.7.1-8.el7.i686.rpm OpenEXR-libs-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: OpenEXR-1.7.1-8.el7.x86_64.rpm OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-devel-1.7.1-8.el7.i686.rpm OpenEXR-devel-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: OpenEXR-1.7.1-8.el7.src.rpm
ppc64: OpenEXR-debuginfo-1.7.1-8.el7.ppc.rpm OpenEXR-debuginfo-1.7.1-8.el7.ppc64.rpm OpenEXR-libs-1.7.1-8.el7.ppc.rpm OpenEXR-libs-1.7.1-8.el7.ppc64.rpm
ppc64le: OpenEXR-debuginfo-1.7.1-8.el7.ppc64le.rpm OpenEXR-libs-1.7.1-8.el7.ppc64le.rpm
s390x: OpenEXR-debuginfo-1.7.1-8.el7.s390.rpm OpenEXR-debuginfo-1.7.1-8.el7.s390x.rpm OpenEXR-libs-1.7.1-8.el7.s390.rpm OpenEXR-libs-1.7.1-8.el7.s390x.rpm
x86_64: OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-libs-1.7.1-8.el7.i686.rpm OpenEXR-libs-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64: OpenEXR-1.7.1-8.el7.ppc64.rpm OpenEXR-debuginfo-1.7.1-8.el7.ppc.rpm OpenEXR-debuginfo-1.7.1-8.el7.ppc64.rpm OpenEXR-devel-1.7.1-8.el7.ppc.rpm OpenEXR-devel-1.7.1-8.el7.ppc64.rpm
ppc64le: OpenEXR-1.7.1-8.el7.ppc64le.rpm OpenEXR-debuginfo-1.7.1-8.el7.ppc64le.rpm OpenEXR-devel-1.7.1-8.el7.ppc64le.rpm
s390x: OpenEXR-1.7.1-8.el7.s390x.rpm OpenEXR-debuginfo-1.7.1-8.el7.s390.rpm OpenEXR-debuginfo-1.7.1-8.el7.s390x.rpm OpenEXR-devel-1.7.1-8.el7.s390.rpm OpenEXR-devel-1.7.1-8.el7.s390x.rpm
x86_64: OpenEXR-1.7.1-8.el7.x86_64.rpm OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-devel-1.7.1-8.el7.i686.rpm OpenEXR-devel-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: OpenEXR-1.7.1-8.el7.src.rpm
x86_64: OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-libs-1.7.1-8.el7.i686.rpm OpenEXR-libs-1.7.1-8.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: OpenEXR-1.7.1-8.el7.x86_64.rpm OpenEXR-debuginfo-1.7.1-8.el7.i686.rpm OpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm OpenEXR-devel-1.7.1-8.el7.i686.rpm OpenEXR-devel-1.7.1-8.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2020-11761 https://access.redhat.com/security/cve/CVE-2020-11763 https://access.redhat.com/security/cve/CVE-2020-11764 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBX3OhUtzjgjWX9erEAQhyFQ/+J5Ul3SoJTvzk/7rqW/WA4GkT5/I6owm1 BnhvO6tELbBul8250MCo/jaUukdjQ3bJ/ZdjmPFrPgNR7UrmIN0LQdAiDlMtnhIF 7Ppw7RDniUBtv3Q2471W4FQxpeXKf+n5sqkq+blxZbeYLXI7Nya/2qKirO0dJ4M1 bAl1exBJ4cSp+kuUOn8oBsGQi6L2oM6ldPf4KklMswOU69qDexywZNtvQVfANmur mNIx/9bmQG+WRlj941A1BFTsAdXsCyTc3qaBecC5iEFxKPkVlpfBhQJ+N6zxdKwj CtVftLiGpcuiWck6THkpPbQg9HWqtJI3tQyW5NUZFHhUnwvOw3SGKgN3ufsnS/tF 9MsnwovV+6kuR/k1UWiDXuSZrdjEIOSz0We8oT5VhOKNkXcE0OY4yxLKpVTlP1HN aM2OGkf3DiUdKEysSQ7yPa2tfimLYQS/XJo6w4FZPKapmOvF926/R7NgIIucvG4J U51DVzqGpkt40pK790wQLrwUZ/E+HYyeZpPJC8QrmJmPNXsXFEm4iYxjCIyaecKf hOlBFwy7mU6fuOLynrrfxeStoS0+zJFfYqdiKOfTpRoLozBqaA8Vt8VasOfOwGeY Ar+nuTxwoQn3KCSGvHk533UkNyqKqpNDIfyqk3M8y8S5HjXvoMx9zxaN0ujT4/pB vySbS8H4PEI=P3yT -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-4339-1 April 27, 2020
openexr vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in OpenEXR.
Software Description: - openexr: tools for the OpenEXR image format
Details:
Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)
Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2018-18444)
Samuel Groß discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2020-11758, CVE-2020-11759, CVE-2020-11760, CVE-2020-11761, CVE-2020-11762, CVE-2020-11763, CVE-2020-11764)
It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service. (CVE-2020-11765)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04: libopenexr24 2.3.0-6ubuntu0.1 openexr 2.3.0-6ubuntu0.1
Ubuntu 19.10: libopenexr23 2.2.1-4.1ubuntu1.1 openexr 2.2.1-4.1ubuntu1.1
Ubuntu 18.04 LTS: libopenexr22 2.2.0-11.1ubuntu1.2 openexr 2.2.0-11.1ubuntu1.2
Ubuntu 16.04 LTS: libopenexr22 2.2.0-10ubuntu2.2 openexr 2.2.0-10ubuntu2.2
In general, a standard system update will make all the necessary changes.
For the stable distribution (buster), these problems have been fixed in version 2.2.1-4.1+deb10u1.
We recommend that you upgrade your openexr packages.
For the detailed security status of openexr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openexr
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl9KkM8ACgkQEMKTtsN8 TjYiCxAAqny8A+WbtYBonQ42ciQ2Hc1f90CI6l1Gp/ZK7RARL7+cLOHTh+hEniIG G6cwDGAwAgOtNPer+bT8Mwx6gF8bTii3nF5MMhiN22L7buzHruxsqpC+g94MeZHW vn6GpkTCPSHW5m4+O3pwrYDK3lr5ucNwPVegcXqtJuG0SrhY9VyTrtmzwtoP0YVx ANOpJhCLNEU5vIdEpzIfdjAoM6nsGG/FDN5sP2B9sEB69s7dQXAX5ksuu4Rg71bo W7OjAWB+1MIuFT2blax4Z0qD9Nuiy252AM9MAzMmdBPsFnix0/E2lmyd2OGknUkY l+sq61TR7pA7AVbtLpLBy2fKFS/Jj1KTFI6J+GmZiOBGAzHrWevjyclYBRI0exVg zKnI2IdO9f0qdeTiZhtAcSEV8hb1mSoo0fPRM0ZGxdMV0MTNeOmj+doTTw+SlSJK 3iyKUDgRy60JjQMq8gBaPSRl6tuTjEdFzbJLsFPvZVY5vQsy4KIuh024RrEjri0c R2oLvboIS2xddK+T/9NPc15vruZiUut0j/3EsBqbDn3hBXMpQb0NFv0kuC+uvmwZ UgxRA32shnjcUES8+TBqeB+cvMnukTlOfqQEY2VNhG//45gcQH6rEcf45W07XTGD djd3v06+rkeUhfuZHL9OAOj2BowTrp9CRooWT1dufPPUkL1aoUY= =FDcC -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202004-0471",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.10.8"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.20"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.4.8"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.15.6"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "18.04"
},
{
"model": "openexr",
"scope": "lt",
"trust": 1.0,
"vendor": "openexr",
"version": "2.4.1"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.6"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.6"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "16.04"
},
{
"model": "ipados",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.6"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.13.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.6"
},
{
"model": "mac os x",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "20.04"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.13.6"
},
{
"model": "mac os x",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.13.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "19.10"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "32"
},
{
"model": "icloud",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.0"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "6.2.8"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.3"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.8,
"vendor": "openexr",
"version": "2.4.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.0.4"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.0.7"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.1.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.1.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.2.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.2.2"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.3.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.3.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.3.2"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.4.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.7.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "1.7.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.0.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.0.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.1.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.2.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.2.1"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.3.0"
},
{
"model": "openexr",
"scope": "eq",
"trust": 0.1,
"vendor": "openexr",
"version": "2.4.0"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:openexr:openexr",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "159359"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
}
],
"trust": 0.7
},
"cve": "CVE-2020-11761",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2020-11761",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-004071",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-164372",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.8,
"id": "CVE-2020-11761",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-004071",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-11761",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "JVNDB-2020-004071",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202004-952",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-164372",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-11761",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. OpenEXR Exists in an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be put into a state. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. A buffer error vulnerability exists in the \u0027FastHufDecoder::refill\u0027 function of the ImfFastHuf.cpp file in LIM OpenEXR versions prior to 2.4.1. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202107-27\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: OpenEXR: Multiple vulnerabilities\n Date: July 11, 2021\n Bugs: #717474, #746794, #762862, #770229, #776808\n ID: 202107-27\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in OpenEXR, the worst of which\ncould result in the arbitrary execution of code. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 media-libs/openexr \u003c 2.5.6 \u003e= 2.5.6 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in OpenEXR. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll OpenEXR users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=media-libs/openexr-2.5.6\"\n\nReferences\n==========\n\n[ 1 ] CVE-2020-11758\n https://nvd.nist.gov/vuln/detail/CVE-2020-11758\n[ 2 ] CVE-2020-11759\n https://nvd.nist.gov/vuln/detail/CVE-2020-11759\n[ 3 ] CVE-2020-11760\n https://nvd.nist.gov/vuln/detail/CVE-2020-11760\n[ 4 ] CVE-2020-11761\n https://nvd.nist.gov/vuln/detail/CVE-2020-11761\n[ 5 ] CVE-2020-11762\n https://nvd.nist.gov/vuln/detail/CVE-2020-11762\n[ 6 ] CVE-2020-11763\n https://nvd.nist.gov/vuln/detail/CVE-2020-11763\n[ 7 ] CVE-2020-11764\n https://nvd.nist.gov/vuln/detail/CVE-2020-11764\n[ 8 ] CVE-2020-11765\n https://nvd.nist.gov/vuln/detail/CVE-2020-11765\n[ 9 ] CVE-2020-15304\n https://nvd.nist.gov/vuln/detail/CVE-2020-15304\n[ 10 ] CVE-2020-15305\n https://nvd.nist.gov/vuln/detail/CVE-2020-15305\n[ 11 ] CVE-2020-15306\n https://nvd.nist.gov/vuln/detail/CVE-2020-15306\n[ 12 ] CVE-2021-20296\n https://nvd.nist.gov/vuln/detail/CVE-2021-20296\n[ 13 ] CVE-2021-3474\n https://nvd.nist.gov/vuln/detail/CVE-2021-3474\n[ 14 ] CVE-2021-3475\n https://nvd.nist.gov/vuln/detail/CVE-2021-3475\n[ 15 ] CVE-2021-3476\n https://nvd.nist.gov/vuln/detail/CVE-2021-3476\n[ 16 ] CVE-2021-3477\n https://nvd.nist.gov/vuln/detail/CVE-2021-3477\n[ 17 ] CVE-2021-3478\n https://nvd.nist.gov/vuln/detail/CVE-2021-3478\n[ 18 ] CVE-2021-3479\n https://nvd.nist.gov/vuln/detail/CVE-2021-3479\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202107-27\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2021 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: OpenEXR security update\nAdvisory ID: RHSA-2020:4039-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:4039\nIssue date: 2020-09-29\nCVE Names: CVE-2020-11761 CVE-2020-11763 CVE-2020-11764\n====================================================================\n1. Summary:\n\nAn update for OpenEXR is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nOpenEXR is a high dynamic-range (HDR) image file format developed by\nIndustrial Light \u0026 Magic for use in computer imaging applications. This\npackage contains libraries and sample applications for handling the format. \n\nSecurity Fix(es):\n\n* OpenEXR: out-of-bounds read during Huffman uncompression (CVE-2020-11761)\n\n* OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp\n(CVE-2020-11763)\n\n* OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in\nImfMisc.cpp (CVE-2020-11764)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.9 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nOpenEXR-1.7.1-8.el7.src.rpm\n\nx86_64:\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-libs-1.7.1-8.el7.i686.rpm\nOpenEXR-libs-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nOpenEXR-1.7.1-8.el7.x86_64.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-devel-1.7.1-8.el7.i686.rpm\nOpenEXR-devel-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nOpenEXR-1.7.1-8.el7.src.rpm\n\nx86_64:\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-libs-1.7.1-8.el7.i686.rpm\nOpenEXR-libs-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nOpenEXR-1.7.1-8.el7.x86_64.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-devel-1.7.1-8.el7.i686.rpm\nOpenEXR-devel-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nOpenEXR-1.7.1-8.el7.src.rpm\n\nppc64:\nOpenEXR-debuginfo-1.7.1-8.el7.ppc.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.ppc64.rpm\nOpenEXR-libs-1.7.1-8.el7.ppc.rpm\nOpenEXR-libs-1.7.1-8.el7.ppc64.rpm\n\nppc64le:\nOpenEXR-debuginfo-1.7.1-8.el7.ppc64le.rpm\nOpenEXR-libs-1.7.1-8.el7.ppc64le.rpm\n\ns390x:\nOpenEXR-debuginfo-1.7.1-8.el7.s390.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.s390x.rpm\nOpenEXR-libs-1.7.1-8.el7.s390.rpm\nOpenEXR-libs-1.7.1-8.el7.s390x.rpm\n\nx86_64:\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-libs-1.7.1-8.el7.i686.rpm\nOpenEXR-libs-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nOpenEXR-1.7.1-8.el7.ppc64.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.ppc.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.ppc64.rpm\nOpenEXR-devel-1.7.1-8.el7.ppc.rpm\nOpenEXR-devel-1.7.1-8.el7.ppc64.rpm\n\nppc64le:\nOpenEXR-1.7.1-8.el7.ppc64le.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.ppc64le.rpm\nOpenEXR-devel-1.7.1-8.el7.ppc64le.rpm\n\ns390x:\nOpenEXR-1.7.1-8.el7.s390x.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.s390.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.s390x.rpm\nOpenEXR-devel-1.7.1-8.el7.s390.rpm\nOpenEXR-devel-1.7.1-8.el7.s390x.rpm\n\nx86_64:\nOpenEXR-1.7.1-8.el7.x86_64.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-devel-1.7.1-8.el7.i686.rpm\nOpenEXR-devel-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nOpenEXR-1.7.1-8.el7.src.rpm\n\nx86_64:\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-libs-1.7.1-8.el7.i686.rpm\nOpenEXR-libs-1.7.1-8.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nOpenEXR-1.7.1-8.el7.x86_64.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.i686.rpm\nOpenEXR-debuginfo-1.7.1-8.el7.x86_64.rpm\nOpenEXR-devel-1.7.1-8.el7.i686.rpm\nOpenEXR-devel-1.7.1-8.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-11761\nhttps://access.redhat.com/security/cve/CVE-2020-11763\nhttps://access.redhat.com/security/cve/CVE-2020-11764\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX3OhUtzjgjWX9erEAQhyFQ/+J5Ul3SoJTvzk/7rqW/WA4GkT5/I6owm1\nBnhvO6tELbBul8250MCo/jaUukdjQ3bJ/ZdjmPFrPgNR7UrmIN0LQdAiDlMtnhIF\n7Ppw7RDniUBtv3Q2471W4FQxpeXKf+n5sqkq+blxZbeYLXI7Nya/2qKirO0dJ4M1\nbAl1exBJ4cSp+kuUOn8oBsGQi6L2oM6ldPf4KklMswOU69qDexywZNtvQVfANmur\nmNIx/9bmQG+WRlj941A1BFTsAdXsCyTc3qaBecC5iEFxKPkVlpfBhQJ+N6zxdKwj\nCtVftLiGpcuiWck6THkpPbQg9HWqtJI3tQyW5NUZFHhUnwvOw3SGKgN3ufsnS/tF\n9MsnwovV+6kuR/k1UWiDXuSZrdjEIOSz0We8oT5VhOKNkXcE0OY4yxLKpVTlP1HN\naM2OGkf3DiUdKEysSQ7yPa2tfimLYQS/XJo6w4FZPKapmOvF926/R7NgIIucvG4J\nU51DVzqGpkt40pK790wQLrwUZ/E+HYyeZpPJC8QrmJmPNXsXFEm4iYxjCIyaecKf\nhOlBFwy7mU6fuOLynrrfxeStoS0+zJFfYqdiKOfTpRoLozBqaA8Vt8VasOfOwGeY\nAr+nuTxwoQn3KCSGvHk533UkNyqKqpNDIfyqk3M8y8S5HjXvoMx9zxaN0ujT4/pB\nvySbS8H4PEI=P3yT\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. ==========================================================================\nUbuntu Security Notice USN-4339-1\nApril 27, 2020\n\nopenexr vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04\n- Ubuntu 19.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in OpenEXR. \n\nSoftware Description:\n- openexr: tools for the OpenEXR image format\n\nDetails:\n\nBrandon Perry discovered that OpenEXR incorrectly handled certain malformed\nEXR image files. If a user were tricked into opening a crafted EXR image\nfile, a remote attacker could cause a denial of service, or possibly\nexecute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. \n(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)\n\nTan Jie discovered that OpenEXR incorrectly handled certain malformed EXR\nimage files. If a user were tricked into opening a crafted EXR image file,\na remote attacker could cause a denial of service, or possibly execute\narbitrary code. This issue only applied to Ubuntu 20.04 LTS. \n(CVE-2018-18444)\n\nSamuel Gro\u00df discovered that OpenEXR incorrectly handled certain malformed\nEXR image files. If a user were tricked into opening a crafted EXR image\nfile, a remote attacker could cause a denial of service, or possibly\nexecute arbitrary code. (CVE-2020-11758, CVE-2020-11759, CVE-2020-11760,\nCVE-2020-11761, CVE-2020-11762, CVE-2020-11763, CVE-2020-11764)\n\nIt was discovered that OpenEXR incorrectly handled certain malformed EXR\nimage files. If a user were tricked into opening a crafted EXR image\nfile, a remote attacker could cause a denial of service. (CVE-2020-11765)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04:\n libopenexr24 2.3.0-6ubuntu0.1\n openexr 2.3.0-6ubuntu0.1\n\nUbuntu 19.10:\n libopenexr23 2.2.1-4.1ubuntu1.1\n openexr 2.2.1-4.1ubuntu1.1\n\nUbuntu 18.04 LTS:\n libopenexr22 2.2.0-11.1ubuntu1.2\n openexr 2.2.0-11.1ubuntu1.2\n\nUbuntu 16.04 LTS:\n libopenexr22 2.2.0-10ubuntu2.2\n openexr 2.2.0-10ubuntu2.2\n\nIn general, a standard system update will make all the necessary changes. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.2.1-4.1+deb10u1. \n\nWe recommend that you upgrade your openexr packages. \n\nFor the detailed security status of openexr please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openexr\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl9KkM8ACgkQEMKTtsN8\nTjYiCxAAqny8A+WbtYBonQ42ciQ2Hc1f90CI6l1Gp/ZK7RARL7+cLOHTh+hEniIG\nG6cwDGAwAgOtNPer+bT8Mwx6gF8bTii3nF5MMhiN22L7buzHruxsqpC+g94MeZHW\nvn6GpkTCPSHW5m4+O3pwrYDK3lr5ucNwPVegcXqtJuG0SrhY9VyTrtmzwtoP0YVx\nANOpJhCLNEU5vIdEpzIfdjAoM6nsGG/FDN5sP2B9sEB69s7dQXAX5ksuu4Rg71bo\nW7OjAWB+1MIuFT2blax4Z0qD9Nuiy252AM9MAzMmdBPsFnix0/E2lmyd2OGknUkY\nl+sq61TR7pA7AVbtLpLBy2fKFS/Jj1KTFI6J+GmZiOBGAzHrWevjyclYBRI0exVg\nzKnI2IdO9f0qdeTiZhtAcSEV8hb1mSoo0fPRM0ZGxdMV0MTNeOmj+doTTw+SlSJK\n3iyKUDgRy60JjQMq8gBaPSRl6tuTjEdFzbJLsFPvZVY5vQsy4KIuh024RrEjri0c\nR2oLvboIS2xddK+T/9NPc15vruZiUut0j/3EsBqbDn3hBXMpQb0NFv0kuC+uvmwZ\nUgxRA32shnjcUES8+TBqeB+cvMnukTlOfqQEY2VNhG//45gcQH6rEcf45W07XTGD\ndjd3v06+rkeUhfuZHL9OAOj2BowTrp9CRooWT1dufPPUkL1aoUY=\n=FDcC\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "PACKETSTORM",
"id": "163465"
},
{
"db": "PACKETSTORM",
"id": "159359"
},
{
"db": "PACKETSTORM",
"id": "157403"
},
{
"db": "PACKETSTORM",
"id": "168903"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-11761",
"trust": 3.0
},
{
"db": "PACKETSTORM",
"id": "163465",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "159359",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "157403",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.2985",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1448",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1816",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.3401",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021071101",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "50012",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2020-24154",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-164372",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-11761",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "168903",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "PACKETSTORM",
"id": "163465"
},
{
"db": "PACKETSTORM",
"id": "159359"
},
{
"db": "PACKETSTORM",
"id": "157403"
},
{
"db": "PACKETSTORM",
"id": "168903"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"id": "VAR-202004-0471",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-164372"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:59:07.730000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "OpenEXR Release Notes",
"trust": 0.8,
"url": "https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020"
},
{
"title": "AcademySoftwareFoundation/openexr",
"trust": 0.8,
"url": "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1"
},
{
"title": "Industrial Light and Magic OpenEXR Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=116439"
},
{
"title": "Debian CVElist Bug Report Logs: openexr: CVE-2020-11758 CVE-2020-11759 CVE-2020-11760 CVE-2020-11761 CVE-2020-11762 CVE-2020-11763 CVE-2020-11764 CVE-2020-11765",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=c611c9f78ad3458919de1d9728e6b32b"
},
{
"title": "Ubuntu Security Notice: openexr vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-4339-1"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://usn.ubuntu.com/4339-1/"
},
{
"trust": 1.8,
"url": "https://security.gentoo.org/glsa/202107-27"
},
{
"trust": 1.8,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1987"
},
{
"trust": 1.8,
"url": "https://github.com/academysoftwarefoundation/openexr/blob/master/changes.md#version-241-february-11-2020"
},
{
"trust": 1.8,
"url": "https://github.com/academysoftwarefoundation/openexr/releases/tag/v2.4.1"
},
{
"trust": 1.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11761"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211288"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211289"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211290"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211291"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211293"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211294"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht211295"
},
{
"trust": 1.7,
"url": "https://www.debian.org/security/2020/dsa-4755"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html"
},
{
"trust": 1.7,
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/f4kfgdqg5pvyau7ts5mz7xcs6empvii3/"
},
{
"trust": 0.8,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/f4kfgdqg5pvyau7ts5mz7xcs6empvii3/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11761"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1448/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/163465/gentoo-linux-security-advisory-202107-27.html"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/50012"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/openexr-multiple-vulnerabilities-32108"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021071101"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2985/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht211291"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/157403/ubuntu-security-notice-usn-4339-1.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht211295"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1816/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/159359/red-hat-security-advisory-2020-4039-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3401/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11765"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11763"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11758"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11762"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11764"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15305"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15306"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11759"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11760"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9111"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/125.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959444"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3476"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3478"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20296"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3479"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-15304"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3474"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3475"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3477"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-11764"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2020:4039"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-11763"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-11761"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18444"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openexr/2.3.0-6ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openexr/2.2.0-10ubuntu2.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openexr/2.2.1-4.1ubuntu1.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openexr/2.2.0-11.1ubuntu1.2"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/4339-1"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/openexr"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9115"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9113"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9114"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "PACKETSTORM",
"id": "163465"
},
{
"db": "PACKETSTORM",
"id": "159359"
},
{
"db": "PACKETSTORM",
"id": "157403"
},
{
"db": "PACKETSTORM",
"id": "168903"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-164372"
},
{
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"db": "PACKETSTORM",
"id": "163465"
},
{
"db": "PACKETSTORM",
"id": "159359"
},
{
"db": "PACKETSTORM",
"id": "157403"
},
{
"db": "PACKETSTORM",
"id": "168903"
},
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-14T00:00:00",
"db": "VULHUB",
"id": "VHN-164372"
},
{
"date": "2020-04-14T00:00:00",
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"date": "2020-05-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"date": "2021-07-12T15:22:22",
"db": "PACKETSTORM",
"id": "163465"
},
{
"date": "2020-09-30T15:45:11",
"db": "PACKETSTORM",
"id": "159359"
},
{
"date": "2020-04-27T15:19:30",
"db": "PACKETSTORM",
"id": "157403"
},
{
"date": "2020-08-28T19:12:00",
"db": "PACKETSTORM",
"id": "168903"
},
{
"date": "2020-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2020-04-14T23:15:12.327000",
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-01-09T00:00:00",
"db": "VULHUB",
"id": "VHN-164372"
},
{
"date": "2020-09-09T00:00:00",
"db": "VULMON",
"id": "CVE-2020-11761"
},
{
"date": "2020-05-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-004071"
},
{
"date": "2022-11-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202004-952"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2024-11-21T04:58:33.050000",
"db": "NVD",
"id": "CVE-2020-11761"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OpenEXR Out-of-bounds read vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-004071"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202004-952"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.