CVE-2020-11761 — Out-of-bounds Read in Openexr

CWE-125 — Out-of-bounds Read16 documents10 sources
Severity
5.5MEDIUMNVD
EPSS
0.6%
top 31.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
OpenexrApple IcloudApple Ipados+8 more
Timeline
PublishedApr 14
Latest updateMay 24

Description

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages9 packages

▶NVDopenexr/openexr< 2.4.1
▶Debianopenexr/openexr< 2.5.3-2+3
▶NVDapple/tvos< 13.4.8
▶NVDapple/icloud10.0 — 11.3+1
▶NVDapple/ipados< 13.6

Also affects: Debian Linux 10.0, 9.0, Fedora 32, Ubuntu Linux 16.04, 18.04, 19.10, 20.04

🔴Vulnerability Details

5
GHSA
GHSA-pc2j-g7xf-qpcq: An issue was discovered in OpenEXR before 2↗2022-05-24
▶
OSV
thunderbird vulnerabilities↗2020-04-21
▶
OSV
CVE-2020-11761: An issue was discovered in OpenEXR before 2↗2020-04-14
▶
CVEList
CVE-2020-11761: An issue was discovered in OpenEXR before 2↗2020-04-14
▶
Project0
Fuzzing ImageIO - Project Zero↗2020-04-01
▶

📋Vendor Advisories

7
Apple
CVE-2020-11761: watchOS 6.2.8↗2020-07-15
▶
Apple
CVE-2020-11761: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra↗2020-07-15
▶
Apple
CVE-2020-11761: iOS 13.6 and iPadOS 13.6↗2020-07-15
▶
Apple
CVE-2020-11761: tvOS 13.4.8↗2020-07-15
▶
Ubuntu
OpenEXR vulnerabilities↗2020-04-27
▶

💬Community

3
Bugzilla
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]↗2020-04-28
▶
Bugzilla
CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression↗2020-04-28
▶
Bugzilla
CVE-2020-11761 mingw-OpenEXR: OpenEXR: out-of-bounds read during Huffman uncompression [fedora-all]↗2020-04-28
▶