gsd-2009-1721
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
Aliases
Aliases
{ GSD: { alias: "CVE-2009-1721", description: "The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.", id: "GSD-2009-1721", references: [ "https://www.suse.com/security/cve/CVE-2009-1721.html", "https://www.debian.org/security/2009/dsa-1842", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2009-1721", ], details: "The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.", id: "GSD-2009-1721", modified: "2023-12-13T01:19:47.903077Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2009-1721", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "FEDORA-2009-8132", refsource: "FEDORA", url: "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html", }, { name: "http://support.apple.com/kb/HT3757", refsource: "CONFIRM", url: "http://support.apple.com/kb/HT3757", }, { name: "36123", refsource: "SECUNIA", url: "http://secunia.com/advisories/36123", }, { name: "FEDORA-2009-8136", refsource: "FEDORA", url: "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html", }, { name: "MDVSA-2009:191", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:191", }, { name: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz", refsource: "CONFIRM", url: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz", }, { name: "36753", refsource: "SECUNIA", url: "http://secunia.com/advisories/36753", }, { name: "ADV-2009-2035", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2009/2035", }, { name: "36096", refsource: "SECUNIA", url: "http://secunia.com/advisories/36096", }, { name: "DSA-1842", refsource: "DEBIAN", url: "http://www.debian.org/security/2009/dsa-1842", }, { name: "MDVSA-2009:190", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:190", }, { name: "36030", refsource: "SECUNIA", url: "http://secunia.com/advisories/36030", }, { name: "36032", refsource: "SECUNIA", url: "http://secunia.com/advisories/36032", }, { name: "APPLE-SA-2009-08-05-1", refsource: "APPLE", url: "http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html", }, { name: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz", refsource: "CONFIRM", url: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz", }, { name: "http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff", refsource: "CONFIRM", url: "http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff", }, { name: "35838", refsource: "BID", url: "http://www.securityfocus.com/bid/35838", }, { name: "1022674", refsource: "SECTRACK", url: "http://www.securitytracker.com/id?1022674", }, { name: "USN-831-1", refsource: "UBUNTU", url: "http://www.ubuntu.com/usn/USN-831-1", }, { name: "ADV-2009-2172", refsource: "VUPEN", url: "http://www.vupen.com/english/advisories/2009/2172", }, { name: "TA09-218A", refsource: "CERT", url: "http://www.us-cert.gov/cas/techalerts/TA09-218A.html", }, { name: "SUSE-SR:2009:014", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html", }, ], }, }, "nvd.nist.gov": { cve: { configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:openexr:openexr:1.2.2:*:*:*:*:*:*:*", matchCriteriaId: "7D0003E3-C50B-4C46-8A24-A874A5C137E1", vulnerable: true, }, { criteria: "cpe:2.3:a:openexr:openexr:1.6.1:*:*:*:*:*:*:*", matchCriteriaId: "763A3838-4D7D-4221-963C-8A58560A03F6", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:opensuse:opensuse:10.0:*:*:*:*:*:*:*", matchCriteriaId: "33910C38-56F2-4D36-BBA3-C88E163704B3", vulnerable: true, }, { criteria: "cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*", matchCriteriaId: "C35B68DF-1440-4587-8458-9C5F4D1E43F3", vulnerable: true, }, { criteria: "cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*", matchCriteriaId: "1B42AB65-443B-4655-BAEA-4EB4A43D9509", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", matchCriteriaId: "80C038E4-C24D-45E9-8287-C205C0C07809", versionEndExcluding: "10.5.8", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*", matchCriteriaId: "0F92AB32-E7DE-43F4-B877-1F41FA162EC7", vulnerable: true, }, { criteria: "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*", matchCriteriaId: "8C757774-08E7-40AA-B532-6F705C8F7639", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:*:*:*:*", matchCriteriaId: "C0507E91-567A-41D6-A7E5-5088A39F75FB", vulnerable: true, }, { criteria: "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*", matchCriteriaId: "4747CC68-FAF4-482F-929A-9DA6C24CB663", vulnerable: true, }, { criteria: "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*", matchCriteriaId: "A5D026D0-EF78-438D-BEDD-FC8571F3ACEB", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*", matchCriteriaId: "7000D33B-F3C7-43E8-8FC7-9B97AADC3E12", vulnerable: true, }, { criteria: "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*", matchCriteriaId: "B3BB5EDB-520B-4DEF-B06E-65CA13152824", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], descriptions: [ { lang: "en", value: "The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.", }, { lang: "es", value: "La implementación de la descompresión en la función Imf::hufUncompress en OpenEXR v1.2.2 y v1.6.1 permite a los atacantes dependientes del contexto provocar una denegación de servicio (finalización de la aplicación) o posiblemente ejecutar código de su elección mediante vectores que provocan una estructura de punteros no inicializados.", }, ], id: "CVE-2009-1721", lastModified: "2024-02-09T03:22:38.687", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: true, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2009-07-31T19:00:01.093", references: [ { source: "cve@mitre.org", tags: [ "Mailing List", ], url: "http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", ], url: "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Patch", ], url: "http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Vendor Advisory", ], url: "http://secunia.com/advisories/36030", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Vendor Advisory", ], url: "http://secunia.com/advisories/36032", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://secunia.com/advisories/36096", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://secunia.com/advisories/36123", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://secunia.com/advisories/36753", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Patch", ], url: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Patch", ], url: "http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://support.apple.com/kb/HT3757", }, { source: "cve@mitre.org", tags: [ "Mailing List", ], url: "http://www.debian.org/security/2009/dsa-1842", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:190", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2009:191", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Patch", "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/35838", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id?1022674", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.ubuntu.com/usn/USN-831-1", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "US Government Resource", ], url: "http://www.us-cert.gov/cas/techalerts/TA09-218A.html", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Vendor Advisory", ], url: "http://www.vupen.com/english/advisories/2009/2035", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.vupen.com/english/advisories/2009/2172", }, { source: "cve@mitre.org", tags: [ "Mailing List", ], url: "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", ], url: "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Analyzed", weaknesses: [ { description: [ { lang: "en", value: "CWE-824", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }, }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.