PT-2021-7693 · Openexr+5 · Openexr+5

Dhananjay Arunesh · Published 2021-09-18 · Updated 2023-10-17 · CVE-2021-3933

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenEXR (affected versions not specified)

Description The issue is related to an integer overflow that could occur when OpenEXR processes a crafted file on systems where size t is less than 64 bits. This could cause invalid bytesPerLine and maxBytesPerLine values, leading to problems with application stability or potentially opening up other attack paths. The vulnerability could be exploited by a remote attacker using a specially crafted file, potentially resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2023-1408

BDU:2023-01667

CVE-2021-3933

DLA-3236-1

DSA-5299-1

MGASA-2021-0524

OESA-2022-1775

OPENSUSE-SU-2021:1537-1

OPENSUSE-SU-2021:3844-1

OPENSUSE-SU-2021_1537-1

OPENSUSE-SU-2021_3844-1

ROSA-SA-2023-2248

SUSE-SU-2021:3843-1

SUSE-SU-2021:3844-1

SUSE-SU-2021_3844-1

USN-5144-1

USN-5620-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Openexr

Suse

Ubuntu

References · 55

• https://osv.dev/vulnerability/SUSE-SU-2021:3843-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3933 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26260 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5299-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3933 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5620-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3933 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3933 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-31 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23215 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3844-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1775 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01667 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1537-1 · Vendor Advisory