PT-2009-6684 · Industrial Light & Magic+1 · Openexr+1

Drew Yao · Published 1970-01-01 · Updated 2024-02-09 · CVE-2009-1721

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenEXR versions 1.2.2 through 1.6.1 OpenEXR versions prior to 1.7.0

Description The decompression implementation in the Imf::hufUncompress function allows context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer. Multiple vulnerabilities in the OpenEXR package may lead to a violation of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For OpenEXR versions 1.2.2 through 1.6.1, update to version 1.7.0 or later to resolve the issue. For OpenEXR versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable Imf::hufUncompress function until a patch is available.

Fix

DoS

Access of Uninitialized Pointer

Weakness Enumeration

CWE-189

CWE-824

Related Identifiers

ALT-PU-2013-1292

BDU:2015-02186

BDU:2015-02187

BDU:2015-02188

BDU:2015-09680

CVE-2009-1721

DSA-1842-1

OPENSUSE-SU-2024:10160-1

Affected Products

Alt Linux

Openexr

References · 37

• http://secunia.com/advisories/36032 · Vendor Advisory
• http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz · Patch
• http://debian.org/security/2009/dsa-1842 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2013-1292 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1721 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html · Vendor Advisory
• http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff · Patch
• https://osv.dev/vulnerability/CVE-2009-1721 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09680 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:191 · Vendor Advisory
• http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz · Patch
• https://redhat.com/archives/fedora-package-announce/2009-July/msg01286.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1721 · Security Note
• http://securityfocus.com/bid/35838 · Patch