PT-2009-6684 · Industrial Light & Magic+1 · Openexr+1
Drew Yao
·
Publicado
1970-01-01
·
Atualizado
2024-02-09
·
CVE-2009-1721
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenEXR versions 1.2.2 through 1.6.1
OpenEXR versions prior to 1.7.0
Description
The decompression implementation in the Imf::hufUncompress function allows context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer. Multiple vulnerabilities in the OpenEXR package may lead to a violation of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.
Recommendations
For OpenEXR versions 1.2.2 through 1.6.1, update to version 1.7.0 or later to resolve the issue.
For OpenEXR versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable
Imf::hufUncompress function until a patch is available.Correção
DoS
Access of Uninitialized Pointer
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Openexr