Published: 31/07/2009 Updated: 09/02/2024

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent malicious users to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openexr openexr 1.2.2
openexr openexr 1.6.1
opensuse opensuse 11.0
opensuse opensuse 10.3
opensuse opensuse 10.0
apple mac os x
debian debian linux 5.0
debian debian linux 4.0
canonical ubuntu linux 9.04
canonical ubuntu linux 8.10
canonical ubuntu linux 8.04
fedoraproject fedora 11
fedoraproject fedora 10

Drew Yao discovered several flaws in the way OpenEXR handled certain malformed EXR image files If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2009-1720, CVE-2009-1721) ...

Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1720 Drew Yao discovered integer overflows in the preview and compression code CVE-2009-1721 Drew Yao discovered that an ...

CWE-824 http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz http://www.vupen.com/english/advisories/2009/2035 http://secunia.com/advisories/36032 http://secunia.com/advisories/36030 http://www.debian.org/security/2009/dsa-1842 http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz http://www.securityfocus.com/bid/35838 http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff http://www.mandriva.com/security/advisories?name=MDVSA-2009:190 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:191 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html http://www.vupen.com/english/advisories/2009/2172 http://secunia.com/advisories/36096 http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html http://support.apple.com/kb/HT3757 http://secunia.com/advisories/36123 http://www.securitytracker.com/id?1022674 http://www.us-cert.gov/cas/techalerts/TA09-218A.html http://secunia.com/advisories/36753 http://www.ubuntu.com/usn/USN-831-1 http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html https://usn.ubuntu.com/831-1/https://nvd.nist.gov

CVE-2009-1721

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect