Description (CNA)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AcademySoftwareFoundation / openexr | affected >= 3.3.2, < 3.3.3 |
CWE
CWE-125
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
ADP enrichment
No English description supplied.
No references supplied.