PT-2009-6685 · Openexr · Libopenexr-Dev+3

Chris Ries + 1 · Published 1970-01-01 · Updated 2012-10-23 · CVE-2009-1722

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libopenexr6 versions (affected versions not specified) libopenexr2c2a versions (affected versions not specified) libopenexr-dev versions (affected versions not specified) OpenEXR version 1.2.2

Description The issue affects the compression implementation in OpenEXR, allowing context-dependent attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely.

Recommendations For libopenexr6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libopenexr2c2a, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libopenexr-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For OpenEXR version 1.2.2, consider updating to a version that fixes the heap-based buffer overflow in the compression implementation to prevent potential denial of service or arbitrary code execution.

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-02186

BDU:2015-02187

BDU:2015-02188

CVE-2009-1722

DSA-1842-1

Affected Products

Openexr

Libopenexr-Dev

Libopenexr2C2A

Libopenexr6

References · 26

• http://secunia.com/advisories/36032 · Vendor Advisory
• http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz · Patch
• http://ubuntu.com/usn/USN-831-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02187 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1722 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1722 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1720 · Security Note
• https://osv.dev/vulnerability/CVE-2009-1722 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:191 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1722 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02186 · Security Note
• http://vupen.com/english/advisories/2009/2035 · Vendor Advisory
• http://securityfocus.com/bid/35838 · Patch
• https://security-tracker.debian.org/tracker/CVE-2009-1722 · Vendor Advisory