Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2009-1720

Published: 31/07/2009 Updated: 23/10/2012
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Openexr

Vulnerability Summary

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent malicious users to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.

Vulnerable Product Search on Vulmon Subscribe to Product

openexr openexr 1.2.2

openexr openexr 1.6.1

Vendor Advisories

Ubuntu Security Notice: openexr vulnerabilities
Drew Yao discovered several flaws in the way OpenEXR handled certain malformed EXR image files If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2009-1720, CVE-2009-1721) ...
Debian Security Advisories: DSA-1842-1 openexr -- several vulnerabilities
Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1720 Drew Yao discovered integer overflows in the preview and compression code CVE-2009-1721 Drew Yao discovered that an ...

References

CWE-189http://secunia.com/advisories/36030http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiffhttp://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gzhttp://www.securityfocus.com/bid/35838http://secunia.com/advisories/36032http://www.debian.org/security/2009/dsa-1842http://www.vupen.com/english/advisories/2009/2035http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gzhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:191http://www.mandriva.com/security/advisories?name=MDVSA-2009:190https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.htmlhttp://secunia.com/advisories/36096http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlhttp://support.apple.com/kb/HT3757http://www.vupen.com/english/advisories/2009/2172http://secunia.com/advisories/36123http://www.securitytracker.com/id?1022674http://www.us-cert.gov/cas/techalerts/TA09-218A.htmlhttp://secunia.com/advisories/36753http://www.ubuntu.com/usn/USN-831-1https://github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.htmlhttps://usn.ubuntu.com/831-1/https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook