CVE-2020-11762 — Out-of-bounds Read in Openexr

CWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds WriteCWE-122 — Heap-based Buffer Overflow16 documents10 sources
Severity
5.5MEDIUMNVD
EPSS
0.6%
top 31.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
OpenexrApple IcloudApple Ipados+9 more
Timeline
PublishedApr 14
Latest updateMay 24

Description

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages10 packages

▶NVDopenexr/openexr< 2.4.1
▶Debianopenexr/openexr< 2.5.3-2+3
▶NVDapple/tvos< 13.4.8
▶NVDapple/icloud10.0 — 11.3+1
▶NVDapple/ipados< 13.6

Also affects: Debian Linux 10.0, 9.0, Fedora 32, Ubuntu Linux 16.04, 18.04, 19.10, 20.04

🔴Vulnerability Details

5
GHSA
GHSA-72qj-6vqg-mprg: An issue was discovered in OpenEXR before 2↗2022-05-24
▶
OSV
thunderbird vulnerabilities↗2020-04-21
▶
CVEList
CVE-2020-11762: An issue was discovered in OpenEXR before 2↗2020-04-14
▶
OSV
CVE-2020-11762: An issue was discovered in OpenEXR before 2↗2020-04-14
▶
Project0
Fuzzing ImageIO - Project Zero↗2020-04-01
▶

📋Vendor Advisories

7
Apple
CVE-2020-11762: iOS 13.6 and iPadOS 13.6↗2020-07-15
▶
Apple
CVE-2020-11762: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra↗2020-07-15
▶
Apple
CVE-2020-11762: tvOS 13.4.8↗2020-07-15
▶
Apple
CVE-2020-11762: watchOS 6.2.8↗2020-07-15
▶
Ubuntu
OpenEXR vulnerabilities↗2020-04-27
▶

💬Community

3
Bugzilla
CVE-2020-11762 OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp↗2020-04-28
▶
Bugzilla
CVE-2020-11762 OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp [fedora-all]↗2020-04-28
▶
Bugzilla
CVE-2020-11762 mingw-OpenEXR: OpenEXR: out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp [fedora-all]↗2020-04-28
▶
CVE-2020-11762 — Out-of-bounds Read in Openexr | cvebase