Vulnerability-Lookup

OPENSUSE-SU-2021:1198-1

Vulnerability from csaf_opensuse - Published: 2021-08-25 19:51 - Updated: 2021-08-25 19:51

Summary

Security update for openexr

Severity

Important

Notes

Title of the patch: Security update for openexr

Description of the patch: This update for openexr fixes the following issues: - CVE-2021-20298 [bsc#1188460]: Fixed Out-of-memory in B44Compressor - CVE-2021-20299 [bsc#1188459]: Fixed Null-dereference READ in Imf_2_5:Header:operator - CVE-2021-20300 [bsc#1188458]: Fixed Integer-overflow in Imf_2_5:hufUncompress - CVE-2021-20302 [bsc#1188462]: Fixed Floating-point-exception in Imf_2_5:precalculateTileInfot - CVE-2021-20303 [bsc#1188457]: Fixed Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer - CVE-2021-20304 [bsc#1188461]: Fixed Undefined-shift in Imf_2_5:hufDecode This update was imported from the SUSE:SLE-15:Update update project.

Patchnames: openSUSE-2021-1198

CVE-2021-20298

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2021-20299

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

CVE-2021-20300

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

CVE-2021-20302

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

CVE-2021-20303

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

CVE-2021-20304

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

CVE-2021-3476

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 12 products, the same list as for CVE-2021-20298

Threats

Impact moderate

References

37 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://lists.opensuse.org/archives/list/security…	self
https://lists.opensuse.org/archives/list/security…	self
https://bugzilla.suse.com/1188457	self
https://bugzilla.suse.com/1188458	self
https://bugzilla.suse.com/1188459	self
https://bugzilla.suse.com/1188460	self
https://bugzilla.suse.com/1188461	self
https://bugzilla.suse.com/1188462	self
https://www.suse.com/security/cve/CVE-2021-20298/	self
https://www.suse.com/security/cve/CVE-2021-20299/	self
https://www.suse.com/security/cve/CVE-2021-20300/	self
https://www.suse.com/security/cve/CVE-2021-20302/	self
https://www.suse.com/security/cve/CVE-2021-20303/	self
https://www.suse.com/security/cve/CVE-2021-20304/	self
https://www.suse.com/security/cve/CVE-2021-3476/	self
https://www.suse.com/security/cve/CVE-2021-20298	external
https://bugzilla.suse.com/1188460	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-20299	external
https://bugzilla.suse.com/1188459	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-20300	external
https://bugzilla.suse.com/1188458	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-20302	external
https://bugzilla.suse.com/1188462	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-20303	external
https://bugzilla.suse.com/1188457	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-20304	external
https://bugzilla.suse.com/1188461	external
https://bugzilla.suse.com/1191176	external
https://www.suse.com/security/cve/CVE-2021-3476	external
https://bugzilla.suse.com/1184172	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for openexr",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for openexr fixes the following issues:\n\n- CVE-2021-20298 [bsc#1188460]: Fixed Out-of-memory in B44Compressor\n- CVE-2021-20299 [bsc#1188459]: Fixed Null-dereference READ in Imf_2_5:Header:operator\n- CVE-2021-20300 [bsc#1188458]: Fixed Integer-overflow in Imf_2_5:hufUncompress\n- CVE-2021-20302 [bsc#1188462]: Fixed Floating-point-exception in Imf_2_5:precalculateTileInfot\n- CVE-2021-20303 [bsc#1188457]: Fixed Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer\n- CVE-2021-20304 [bsc#1188461]: Fixed Undefined-shift in Imf_2_5:hufDecode\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-1198",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_1198-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:1198-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UU6C6KHVOWCVMKES2H2PK5BJGOG2DVEJ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:1198-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UU6C6KHVOWCVMKES2H2PK5BJGOG2DVEJ/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188457",
        "url": "https://bugzilla.suse.com/1188457"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188458",
        "url": "https://bugzilla.suse.com/1188458"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188459",
        "url": "https://bugzilla.suse.com/1188459"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188460",
        "url": "https://bugzilla.suse.com/1188460"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188461",
        "url": "https://bugzilla.suse.com/1188461"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1188462",
        "url": "https://bugzilla.suse.com/1188462"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20298 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20298/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20299 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20299/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20300 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20300/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20302 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20302/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20303 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20303/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20304 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20304/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3476 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3476/"
      }
    ],
    "title": "Security update for openexr",
    "tracking": {
      "current_release_date": "2021-08-25T19:51:46Z",
      "generator": {
        "date": "2021-08-25T19:51:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:1198-1",
      "initial_release_date": "2021-08-25T19:51:46Z",
      "revision_history": [
        {
          "date": "2021-08-25T19:51:46Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
                "product": {
                  "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
                  "product_id": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
                "product": {
                  "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
                  "product_id": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-2.2.1-lp152.7.20.1.i586",
                "product": {
                  "name": "openexr-2.2.1-lp152.7.20.1.i586",
                  "product_id": "openexr-2.2.1-lp152.7.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-devel-2.2.1-lp152.7.20.1.i586",
                "product": {
                  "name": "openexr-devel-2.2.1-lp152.7.20.1.i586",
                  "product_id": "openexr-devel-2.2.1-lp152.7.20.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-doc-2.2.1-lp152.7.20.1.i586",
                "product": {
                  "name": "openexr-doc-2.2.1-lp152.7.20.1.i586",
                  "product_id": "openexr-doc-2.2.1-lp152.7.20.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "openexr-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "openexr-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-devel-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "openexr-devel-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "openexr-devel-2.2.1-lp152.7.20.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openexr-doc-2.2.1-lp152.7.20.1.x86_64",
                "product": {
                  "name": "openexr-doc-2.2.1-lp152.7.20.1.x86_64",
                  "product_id": "openexr-doc-2.2.1-lp152.7.20.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586"
        },
        "product_reference": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586"
        },
        "product_reference": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-2.2.1-lp152.7.20.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586"
        },
        "product_reference": "openexr-2.2.1-lp152.7.20.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "openexr-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-devel-2.2.1-lp152.7.20.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586"
        },
        "product_reference": "openexr-devel-2.2.1-lp152.7.20.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-devel-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "openexr-devel-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-doc-2.2.1-lp152.7.20.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586"
        },
        "product_reference": "openexr-doc-2.2.1-lp152.7.20.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openexr-doc-2.2.1-lp152.7.20.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        },
        "product_reference": "openexr-doc-2.2.1-lp152.7.20.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20298",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20298"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20298",
          "url": "https://www.suse.com/security/cve/CVE-2021-20298"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188460 for CVE-2021-20298",
          "url": "https://bugzilla.suse.com/1188460"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20298",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20298"
    },
    {
      "cve": "CVE-2021-20299",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20299"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20299",
          "url": "https://www.suse.com/security/cve/CVE-2021-20299"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188459 for CVE-2021-20299",
          "url": "https://bugzilla.suse.com/1188459"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20299",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20299"
    },
    {
      "cve": "CVE-2021-20300",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20300"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20300",
          "url": "https://www.suse.com/security/cve/CVE-2021-20300"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188458 for CVE-2021-20300",
          "url": "https://bugzilla.suse.com/1188458"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20300",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20300"
    },
    {
      "cve": "CVE-2021-20302",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20302"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20302",
          "url": "https://www.suse.com/security/cve/CVE-2021-20302"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188462 for CVE-2021-20302",
          "url": "https://bugzilla.suse.com/1188462"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20302",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20302"
    },
    {
      "cve": "CVE-2021-20303",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20303"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20303",
          "url": "https://www.suse.com/security/cve/CVE-2021-20303"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188457 for CVE-2021-20303",
          "url": "https://bugzilla.suse.com/1188457"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20303",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20303"
    },
    {
      "cve": "CVE-2021-20304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20304",
          "url": "https://www.suse.com/security/cve/CVE-2021-20304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188461 for CVE-2021-20304",
          "url": "https://bugzilla.suse.com/1188461"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191176 for CVE-2021-20304",
          "url": "https://bugzilla.suse.com/1191176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20304"
    },
    {
      "cve": "CVE-2021-3476",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3476"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenEXR\u0027s B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
          "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3476",
          "url": "https://www.suse.com/security/cve/CVE-2021-3476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184172 for CVE-2021-3476",
          "url": "https://bugzilla.suse.com/1184172"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImf-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-devel-2.2.1-lp152.7.20.1.x86_64",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.i586",
            "openSUSE Leap 15.2:openexr-doc-2.2.1-lp152.7.20.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-08-25T19:51:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-3476"
    }
  ]
}

CVE-2021-20298 (GCVE-0-2021-20298)

Vulnerability from cvelistv5 – Published: 2022-08-23 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.

Severity

No CVSS data available.

CWE

CWE-400 - - Uncontrolled Resource Consumption

Assigner

redhat redhat root

References

6 references

URL	Tags
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://github.com/AcademySoftwareFoundation/open…
https://bugzilla.redhat.com/show_bug.cgi?id=1939156
https://access.redhat.com/security/cve/CVE-2021-20298
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Fixed in OpenEXR 3.0.0-beta

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25913"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/843"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/85fd638ae0d5fa132434f4cbf32590261c1dba97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939156"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-20298"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenEXR 3.0.0-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 - Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25913"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/843"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/85fd638ae0d5fa132434f4cbf32590261c1dba97"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939156"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-20298"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20298",
    "datePublished": "2022-08-23T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20299 (GCVE-0-2021-20299)

Vulnerability from cvelistv5 – Published: 2022-03-16 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Severity

No CVSS data available.

CWE

CWE-476 - (NULL Pointer Dereference)

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://bugzilla.redhat.com/show_bug.cgi?id=1939154
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Affected before v2.5.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939154"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Affected before v2.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 (NULL Pointer Dereference)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0f"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939154"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20299",
    "datePublished": "2022-03-16T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20300 (GCVE-0-2021-20300)

Vulnerability from cvelistv5 – Published: 2022-03-04 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.

Severity

No CVSS data available.

CWE

CWE-190 - - Integer Overflow or Wraparound

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1939153
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Fixed in v2.5.4 and beyond.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.704Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939153"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25562"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/836"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in v2.5.4 and beyond."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 - Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939153"
        },
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25562"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/836"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20300",
    "datePublished": "2022-03-04T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20302 (GCVE-0-2021-20302)

Vulnerability from cvelistv5 – Published: 2022-03-04 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.

Severity

No CVSS data available.

CWE

CWE-20 - - Improper Input Validation

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1939161
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Fixed in v2.5.4 and beyond.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939161"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25894"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/842"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in v2.5.4 and beyond."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 - Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939161"
        },
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25894"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/842"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20302",
    "datePublished": "2022-03-04T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20303 (GCVE-0-2021-20303)

Vulnerability from cvelistv5 – Published: 2022-03-04 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.

Severity

No CVSS data available.

CWE

CWE-190 - - Integer Overflow or Wraparound, CWE-787 - Out-of-bounds Write

Assigner

redhat redhat root

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1939151
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Fixed in v2.5.4 and beyond.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.668Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939151"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25505"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/831"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in v2.5.4 and beyond."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 - Integer Overflow or Wraparound,  CWE-787 - Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939151"
        },
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25505"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/831"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20303",
    "datePublished": "2022-03-04T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20304 (GCVE-0-2021-20304)

Vulnerability from cvelistv5 – Published: 2022-08-23 00:00 – Updated: 2024-08-03 17:37

Summary

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.

Severity

No CVSS data available.

CWE

CWE-190 - - Integer Overflow or Wraparound

Assigner

redhat redhat root

References

6 references

URL	Tags
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://github.com/AcademySoftwareFoundation/open…
https://github.com/AcademySoftwareFoundation/open…
https://bugzilla.redhat.com/show_bug.cgi?id=1939157
https://access.redhat.com/security/cve/CVE-2021-20304
https://security.gentoo.org/glsa/202210-31	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: Fixed in OpenEXR 3.0.0-beta

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.947Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26229"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/849"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/51a92d67f53c08230734e74564c807043cbfe41e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939157"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-20304"
          },
          {
            "name": "GLSA-202210-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-31"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenEXR 3.0.0-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 - Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-31T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26229"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/pull/849"
        },
        {
          "url": "https://github.com/AcademySoftwareFoundation/openexr/commit/51a92d67f53c08230734e74564c807043cbfe41e"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939157"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-20304"
        },
        {
          "name": "GLSA-202210-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20304",
    "datePublished": "2022-08-23T00:00:00.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3476 (GCVE-0-2021-3476)

Vulnerability from cvelistv5 – Published: 2021-03-30 00:00 – Updated: 2024-08-03 16:53

Summary

A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability.

Severity

No CVSS data available.

CWE

CWE-190

Assigner

redhat redhat root

References

5 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1939145
https://bugs.chromium.org/p/oss-fuzz/issues/detai…
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://security.gentoo.org/glsa/202107-27	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
n/a	OpenEXR	Affected: OpenEXR 3.0.0-beta

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939145"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24787"
          },
          {
            "name": "[debian-lts-announce] 20210703 [SECURITY] [DLA 2701-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html"
          },
          {
            "name": "GLSA-202107-27",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-27"
          },
          {
            "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenEXR",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "OpenEXR 3.0.0-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenEXR\u0027s B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-12T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939145"
        },
        {
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24787"
        },
        {
          "name": "[debian-lts-announce] 20210703 [SECURITY] [DLA 2701-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html"
        },
        {
          "name": "GLSA-202107-27",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202107-27"
        },
        {
          "name": "[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3476",
    "datePublished": "2021-03-30T00:00:00.000Z",
    "dateReserved": "2021-03-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T16:53:17.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2021:1198-1

CVE-2021-20298 (GCVE-0-2021-20298)

CVE-2021-20299 (GCVE-0-2021-20299)

CVE-2021-20300 (GCVE-0-2021-20300)

CVE-2021-20302 (GCVE-0-2021-20302)

CVE-2021-20303 (GCVE-0-2021-20303)

CVE-2021-20304 (GCVE-0-2021-20304)

CVE-2021-3476 (GCVE-0-2021-3476)

Tags

Sightings

Nomenclature

Related by attack behaviour