Lucene search

MitreCVE-2009-1720

HistoryJul 31, 2009 - 7:00 p.m.

CVE-2009-1720

2009-07-3119:00:01

CWE-189

mitre

web.nvd.nist.gov

openexr

integer overflow

denial of service

arbitrary code execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

Low

EPSS

0.04

Percentile

92.1%

JSON

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

openexropenexrMatch1.2.2

openexropenexrMatch1.6.1

VendorProductVersionCPE
openexropenexr1.2.2cpe:/a:openexr:openexr:1.2.2:::
openexropenexr1.6.1cpe:/a:openexr:openexr:1.6.1:::

Vendor	Product	Version	CPE
openexr	openexr	1.2.2	cpe:/a:openexr:openexr:1.2.2:::
openexr	openexr	1.6.1	cpe:/a:openexr:openexr:1.6.1:::

References

lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html

release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff

secunia.com/advisories/36030

secunia.com/advisories/36032

secunia.com/advisories/36096

secunia.com/advisories/36123

secunia.com/advisories/36753

security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz

security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz

support.apple.com/kb/HT3757

www.debian.org/security/2009/dsa-1842

www.mandriva.com/security/advisories?name=MDVSA-2009:190

www.mandriva.com/security/advisories?name=MDVSA-2009:191

www.securityfocus.com/bid/35838

www.securitytracker.com/id?1022674

www.ubuntu.com/usn/USN-831-1

www.us-cert.gov/cas/techalerts/TA09-218A.html

www.vupen.com/english/advisories/2009/2035

www.vupen.com/english/advisories/2009/2172

github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010

www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html

www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

Low

EPSS

0.04

Percentile

92.1%

JSON

Related for CVE-2009-1720