CVE-2020-11761
published 2020-04-14CVE-2020-11761: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.79%
75.8th percentile
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.20 | 7.20 |
| apple | icloud | >= 10.0 < 11.3 | 11.3 |
| apple | ios_13.6_and_ipados | — | — |
| apple | ipados | < 13.6 | 13.6 |
| apple | iphone_os | < 13.6 | 13.6 |
| apple | itunes | < 12.10.8 | 12.10.8 |
| apple | mac_os_x | < 10.15.6 | 10.15.6 |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | >= 10.13.0 < 10.13.6 | 10.13.6 |
| apple | mac_os_x | >= 10.14.0 < 10.14.6 | 10.14.6 |
| apple | macos_catalina_10.15.6_security_update_2020-004_mojave_security_update_2020-004 | — | — |
| apple | tvos | < 13.4.8 | 13.4.8 |
| apple | tvos | — | — |
| apple | watchos | < 6.2.8 | 6.2.8 |
| apple | watchos | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openexr | < openexr 2.5.3-2 (bookworm) | openexr 2.5.3-2 (bookworm) |
| fedoraproject | fedora | — | — |
| mozilla | thunderbird | >= 0 < 1:68.7.0+build1-0ubuntu0.16.04.2 | 1:68.7.0+build1-0ubuntu0.16.04.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pc2j-g7xf-qpcq: An issue was discovered in OpenEXR before 2
ghsa_unreviewed·2022-05-24
CVE-2020-11761 [MEDIUM] CWE-125 GHSA-pc2j-g7xf-qpcq: An issue was discovered in OpenEXR before 2
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
OSV
openexr vulnerabilities
osv·2020-04-27·CVSS 8.8
CVE-2017-9111 [HIGH] openexr vulnerabilities
openexr vulnerabilities
Brandon Perry discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR image
file, a remote attacker could cause a denial of service, or possibly
execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)
Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2018-18444)
Samuel Groß discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR i
OSV
thunderbird vulnerabilities
osv·2020-04-21·CVSS 8.8
CVE-2019-11757 thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, bypass
same-origin restrictions, conduct cross-site scripting (XSS) attacks, or
execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759,
CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,
CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010,
CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017,
CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503,
CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,
CVE-2020
OSV
CVE-2020-11761: An issue was discovered in OpenEXR before 2
osv·2020-04-14·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: An issue was discovered in OpenEXR before 2
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
Project0
Fuzzing ImageIO - Project Zero
project_zero·2020-04-01
CVE-2020-11758 Fuzzing ImageIO - Project Zero
Posted by Samuel Groß, Project Zero
This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost.
To reiterate an important point, the vulnerabilities described throughout this blog are reachable through popular messengers but are not part of their codebase.
Apple
CVE-2020-11761: watchOS 6.2.8
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: watchOS 6.2.8
Apple Security Update: About the security content of watchOS 6.2.8
Product: watchOS
Version: 6.2.8
CVE: CVE-2020-11761
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11761: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Apple Security Update: About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Product: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
CVE: CVE-2020-11761
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11761: iOS 13.6 and iPadOS 13.6
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: iOS 13.6 and iPadOS 13.6
Apple Security Update: About the security content of iOS 13.6 and iPadOS 13.6
Product: iOS 13.6 and iPadOS
Version: 13.6
CVE: CVE-2020-11761
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11761: tvOS 13.4.8
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: tvOS 13.4.8
Apple Security Update: About the security content of tvOS 13.4.8
Product: tvOS
Version: 13.4.8
CVE: CVE-2020-11761
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Ubuntu
OpenEXR vulnerabilities
vendor_ubuntu·2020-04-27·CVSS 8.8
CVE-2017-9111 [HIGH] OpenEXR vulnerabilities
Title: OpenEXR vulnerabilities
Summary: Several security issues were fixed in OpenEXR.
Brandon Perry discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR image
file, a remote attacker could cause a denial of service, or possibly
execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)
Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2018-18444)
Samuel Groß discovered that OpenEXR incorrectly handled certain malformed
EXR
Red Hat
OpenEXR: out-of-bounds read during Huffman uncompression
vendor_redhat·2020-02-08·CVSS 5.5
CVE-2020-11761 [MEDIUM] CWE-125 OpenEXR: out-of-bounds read during Huffman uncompression
OpenEXR: out-of-bounds read during Huffman uncompression
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
Package: OpenEXR (Red Hat Enterprise Linux 6) - Out of support scope
Package: mingw-OpenEXR (Red Hat Enterprise Linux 8) - Will not fix
Package: OpenEXR (Red Hat Enterprise Linux 8) - Will not fix
Debian
CVE-2020-11761: openexr - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read ...
vendor_debian·2020·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761: openexr - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read ...
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
Scope: local
bookworm: resolved (fixed in 2.5.3-2)
bullseye: resolved (fixed in 2.5.3-2)
forky: resolved (fixed in 2.5.3-2)
sid: resolved (fixed in 2.5.3-2)
trixie: resolved (fixed in 2.5.3-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-11762 OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11762 [MEDIUM] CVE-2020-11762 OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp
CVE-2020-11762 OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
Reference:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
Discussion:
Created OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1829000]
Created mingw-OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1829001]
---
Mitigation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi
Bugzilla
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
Discussion:
Created OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1829004]
Created mingw-OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1829003]
---
OpenEXR versions shipped with Red Hat Enterprise Linux 7 and 8 are affected by this flaw.
---
This commit appears to be part of the upstream patch: https://github.com/AcademySoftwareF
Bugzilla
CVE-2020-11761 mingw-OpenEXR: OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11761 [MEDIUM] CVE-2020-11761 mingw-OpenEXR: OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
CVE-2020-11761 mingw-OpenEXR: OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1987https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1https://lists.debian.org/debian-lts-announce/2020/08/msg00056.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/https://security.gentoo.org/glsa/202107-27https://support.apple.com/kb/HT211288https://support.apple.com/kb/HT211289https://support.apple.com/kb/HT211290https://support.apple.com/kb/HT211291https://support.apple.com/kb/HT211293https://support.apple.com/kb/HT211294https://support.apple.com/kb/HT211295https://usn.ubuntu.com/4339-1/https://www.debian.org/security/2020/dsa-4755http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1987https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1https://lists.debian.org/debian-lts-announce/2020/08/msg00056.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/https://security.gentoo.org/glsa/202107-27https://support.apple.com/kb/HT211288https://support.apple.com/kb/HT211289https://support.apple.com/kb/HT211290https://support.apple.com/kb/HT211291https://support.apple.com/kb/HT211293https://support.apple.com/kb/HT211294https://support.apple.com/kb/HT211295https://usn.ubuntu.com/4339-1/https://www.debian.org/security/2020/dsa-4755
2020-04-14
Published