7.1

CVE-2021-20302

A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openexr ≫ Openexr Version < 2.5.4
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.93% 0.564
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvd@nist.gov 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:N/I:N/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
Third Party Advisory
Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25894
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939161
Patch
Third Party Advisory
Issue Tracking
https://github.com/AcademySoftwareFoundation/openexr/pull/842
Patch
Third Party Advisory