Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
110 results · page 2 of 3
Aug 1, 2025OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.CVE-2025-48074 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 4.6
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
- Product
- openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.CVE-2025-48073 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 4.6
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.
- Product
- openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.CVE-2025-48072 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 6.8
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
- Product
- openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.CVE-2025-48071 · Other software · AcademySoftwareFoundation · reported by GitHubHigh 8.4
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.
- Product
- openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmulCVE-2024-31047 · Other software · openexr · reported by MITRELow 3.3
An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.
- Product
- openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing CVE-2023-5841 · Other software · Academy Software Foundation · reported by cve@takeonme.orgCritical 9.1
Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.
- Product
- OpenEXR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Dec 11, 2023OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing.CVE-2023-50245 · Other software · afichet · reported by GitHubCritical 9.8
OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.
- Product
- openexr-viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022A flaw was found in OpenEXR's hufDecode functionality.CVE-2021-20304 · Other software · Openexr · reported by Red HatHigh 7.5
A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.chromium.org
Aug 23, 2022A flaw was found in OpenEXR's B44Compressor.CVE-2021-20298 · Other software · Openexr · reported by Red HatHigh 7.5
A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.chromium.org
Mar 25, 2022In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` CVE-2021-3941 · Other software · Openexr · reported by Red HatMedium 6.5
In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Mar 25, 2022An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.CVE-2021-3933 · Other software · Openexr · reported by Red HatMedium 5.5
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Mar 16, 2022A flaw was found in OpenEXR's Multipart input file functionality.CVE-2021-20299 · Other software · Openexr · reported by Red HatHigh 7.5
A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 4, 2022A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp.CVE-2021-20303 · Other software · Openexr · reported by Red HatMedium 6.1
A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 4, 2022A flaw was found in OpenEXR's TiledInputFile functionality.CVE-2021-20302 · Other software · Openexr · reported by Red HatMedium 5.5
A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 4, 2022A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp.CVE-2021-20300 · Other software · Openexr · reported by Red HatMedium 5.5
A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Dec 31, 2021OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask aCVE-2021-45942 · Other software · Openexr · reported by MITREMedium 5.5
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Aug 25, 2021There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5.CVE-2021-3605 · Other software · Openexr · reported by Red HatMedium 5.5
There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Jul 21, 2021tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.CVE-2020-19490 · Other software · Tinyexr Project · reported by MITREMedium 5.5
tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
- Product
- Tinyexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2021There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5.CVE-2021-3598 · Other software · Openexr · reported by Red HatMedium 5.5
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Jun 8, 2021An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1.CVE-2021-26945 · Other software · Openexr · reported by Red HatMedium 5.5
An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 8, 2021An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1.CVE-2021-26260 · Other software · Openexr · reported by Red HatMedium 5.5
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Jun 8, 2021An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1.CVE-2021-23215 · Other software · Openexr · reported by Red HatMedium 5.5
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Jun 8, 2021A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.CVE-2021-23169 · Other software · Openexr · reported by Red HatHigh 8.8
A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Apr 1, 2021A flaw was found in OpenEXR in versions before 3.0.0-beta.CVE-2021-20296 · Other software · Openexr · reported by Red HatMedium 5.3
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 31, 2021There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta.CVE-2021-3479 · Other software · Openexr · reported by Red HatMedium 5.5
There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 31, 2021There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta.CVE-2021-3478 · Other software · Openexr · reported by Red HatMedium 5.5
There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 31, 2021There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta.CVE-2021-3477 · Other software · Openexr · reported by Red HatMedium 5.5
There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 30, 2021A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta.CVE-2021-3476 · Other software · Openexr · reported by Red HatMedium 5.3
A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 30, 2021There is a flaw in OpenEXR in versions before 3.0.0-beta.CVE-2021-3475 · Other software · Openexr · reported by Red HatMedium 5.3
There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Mar 30, 2021There's a flaw in OpenEXR in versions before 3.0.0-beta.CVE-2021-3474 · Other software · Openexr · reported by Red HatMedium 5.3
There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
Dec 9, 2020A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service vCVE-2020-16589 · Other software · Openexr · reported by MITREMedium 5.5
A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via CVE-2020-16588 · Other software · Openexr · reported by MITREMedium 5.5
A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that caCVE-2020-16587 · Other software · Openexr · reported by MITREMedium 5.5
A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2020An issue was discovered in OpenEXR before v2.5.2.CVE-2020-15306 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 25, 2020An issue was discovered in OpenEXR before 2.5.2.CVE-2020-15305 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 25, 2020An issue was discovered in OpenEXR before 2.5.2.CVE-2020-15304 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11765 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11764 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11763 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11762 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11761 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11760 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11759 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Apr 14, 2020An issue was discovered in OpenEXR before 2.4.1.CVE-2020-11758 · Other software · Openexr · reported by MITREMedium 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.chromium.org
Oct 17, 2018makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact.CVE-2018-18444 · Other software · ILM · reported by MITREHigh 8.8
makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview.CVE-2018-18443 · Other software · ILM · reported by MITREMedium 4.3
OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2018tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.CVE-2018-12092 · Other software · Tinyexr Project · reported by MITRECritical 9.8
tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
- Product
- Tinyexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2017Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file CVE-2017-14988 · Other software · Openexr · reported by MITREMedium 5.5
Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Aug 6, 2017In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may resuCVE-2017-12596 · Other software · Openexr · reported by MITREHigh 7.8
In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2017In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.CVE-2017-9116 · Other software · Openexr · reported by MITREMedium 6.5
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
- Product
- Openexr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.