CVE-2021-3933

2022-03-2519:15:09

Debian Security Bug Tracker

security-tracker.debian.org

openexr

integer overflow

file processing

system size

application stability

attack paths

unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

33.2%

JSON

An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.

OSVersionArchitecturePackageVersionFilename
Debian12allopenexr< 3.1.5-2openexr_3.1.5-2_all.deb
Debian11allopenexr< 2.5.4-2+deb11u1openexr_2.5.4-2+deb11u1_all.deb
Debian999allopenexr< 3.1.5-2openexr_3.1.5-2_all.deb
Debian13allopenexr< 3.1.5-2openexr_3.1.5-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openexr	< 3.1.5-2	openexr_3.1.5-2_all.deb
Debian	11	all	openexr	< 2.5.4-2+deb11u1	openexr_2.5.4-2+deb11u1_all.deb
Debian	999	all	openexr	< 3.1.5-2	openexr_3.1.5-2_all.deb
Debian	13	all	openexr	< 3.1.5-2	openexr_3.1.5-2_all.deb