PT-2009-6685 · Openexr · Libopenexr-Dev+3

Chris Ries + 1 · Publicado 1970-01-01 · Atualizado 2012-10-23 · CVE-2009-1722

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libopenexr6 versions (affected versions not specified) libopenexr2c2a versions (affected versions not specified) libopenexr-dev versions (affected versions not specified) OpenEXR version 1.2.2

Description The issue affects the compression implementation in OpenEXR, allowing context-dependent attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely.

Recommendations For libopenexr6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libopenexr2c2a, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libopenexr-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For OpenEXR version 1.2.2, consider updating to a version that fixes the heap-based buffer overflow in the compression implementation to prevent potential denial of service or arbitrary code execution.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-189

Identificadores relacionados

BDU:2015-02186

BDU:2015-02187

BDU:2015-02188

CVE-2009-1722

DSA-1842-1

Produtos afetados

Openexr

Libopenexr-Dev

Libopenexr2C2A

Libopenexr6

Referências · 26

• https://github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010 · Nota
• http://secunia.com/advisories/36032 · Aviso do Fabricante
• http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz · Correção
• http://ubuntu.com/usn/USN-831-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-02187 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1722 · Nota de Segurança
• http://vupen.com/english/advisories/2009/2172 · Nota
• http://securitytracker.com/id?1022674 · Nota
• http://debian.org/security/2009/dsa-1842 · Correção, Aviso do Fabricante
• http://debian.org/security/dsa-1842 · Nota
• http://secunia.com/advisories/36096 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1722 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1720 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-1722 · Aviso do Fabricante