CVE-2021-23169

EPSS 0.18%
Veröffentlicht 08.06.2021 12:15:10
Zuletzt bearbeitet 21.11.2024 05:51:19
Quelle secalert@redhat.com
Teams Watchlist Login
Unerledigt Login

A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Openexr ≫ Openexr Version < 3.0.1

Fedoraproject ≫ Fedora Version33

Fedoraproject ≫ Fedora Version34

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.18%	0.393

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://bugzilla.redhat.com/show_bug.cgi?id=1947612

Third Party Advisory

Issue Tracking

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KYNJSMVA6YJY5NMKDZ5SAISKZG2KCKC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/

https://security.gentoo.org/glsa/202210-31

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-23169

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-23169

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-23169

EUVD