CVE-2021-20303

State: Published
Severity: Not scored
Published: Mar 4, 2022
Updated: Aug 3, 2024
Reserved: Dec 17, 2020

Description

A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.

Scores

The record has no CVSS score.

Weaknesses

CWE-190 Integer Overflow or Wraparound, CWE-787 - Out-of-bounds Write

Affected Products

Product	Versions
OpenEXRn/a	Fixed in v2.5.4 and beyond.Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1939151
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25505
https://github.com/AcademySoftwareFoundation/openexr/pull/831
[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.