CVE-2020-11764
published 2020-04-14CVE-2020-11764: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.79%
75.8th percentile
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.20 | 7.20 |
| apple | icloud | >= 10.0 < 11.3 | 11.3 |
| apple | ios_13.6_and_ipados | — | — |
| apple | ipados | < 13.6 | 13.6 |
| apple | iphone_os | < 13.6 | 13.6 |
| apple | itunes | < 12.10.8 | 12.10.8 |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | >= 10.13.0 < 10.13.6 | 10.13.6 |
| apple | mac_os_x | >= 10.14.0 < 10.14.6 | 10.14.6 |
| apple | mac_os_x | >= 10.15 < 10.15.6 | 10.15.6 |
| apple | macos_catalina_10.15.6_security_update_2020-004_mojave_security_update_2020-004 | — | — |
| apple | tvos | < 13.4.8 | 13.4.8 |
| apple | tvos | — | — |
| apple | watchos | < 6.2.8 | 6.2.8 |
| apple | watchos | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openexr | < openexr 2.5.3-2 (bookworm) | openexr 2.5.3-2 (bookworm) |
| fedoraproject | fedora | — | — |
| mozilla | thunderbird | >= 0 < 1:68.7.0+build1-0ubuntu0.16.04.2 | 1:68.7.0+build1-0ubuntu0.16.04.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2020-11764: tvOS 13.4.8
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: tvOS 13.4.8
Apple Security Update: About the security content of tvOS 13.4.8
Product: tvOS
Version: 13.4.8
CVE: CVE-2020-11764
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11764: watchOS 6.2.8
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: watchOS 6.2.8
Apple Security Update: About the security content of watchOS 6.2.8
Product: watchOS
Version: 6.2.8
CVE: CVE-2020-11764
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11764: iOS 13.6 and iPadOS 13.6
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: iOS 13.6 and iPadOS 13.6
Apple Security Update: About the security content of iOS 13.6 and iPadOS 13.6
Product: iOS 13.6 and iPadOS
Version: 13.6
CVE: CVE-2020-11764
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Apple
CVE-2020-11764: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
vendor_apple·2020-07-15·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Apple Security Update: About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Product: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
CVE: CVE-2020-11764
Component: ImageIO
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
Ubuntu
OpenEXR vulnerabilities
vendor_ubuntu·2020-04-27·CVSS 8.8
CVE-2017-9111 [HIGH] OpenEXR vulnerabilities
Title: OpenEXR vulnerabilities
Summary: Several security issues were fixed in OpenEXR.
Brandon Perry discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR image
file, a remote attacker could cause a denial of service, or possibly
execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)
Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2018-18444)
Samuel Groß discovered that OpenEXR incorrectly handled certain malformed
EXR
Red Hat
OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
vendor_redhat·2020-02-08·CVSS 5.5
CVE-2020-11764 [MEDIUM] CWE-787 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: OpenEXR (Red Hat Enterprise Linux 6) - Out of support scope
Package: mingw-OpenEXR (Red Hat Enterprise Linux 8) - Will not fix
Package: OpenEXR (Red Hat Enterprise Linux 8) - Will not fix
Debian
CVE-2020-11764: openexr - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write...
vendor_debian·2020·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: openexr - An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write...
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
Scope: local
bookworm: resolved (fixed in 2.5.3-2)
bullseye: resolved (fixed in 2.5.3-2)
forky: resolved (fixed in 2.5.3-2)
sid: resolved (fixed in 2.5.3-2)
trixie: resolved (fixed in 2.5.3-2)
GHSA
GHSA-cwm8-xj6v-vqwj: An issue was discovered in OpenEXR before 2
ghsa_unreviewed·2022-05-24
CVE-2020-11764 [MEDIUM] CWE-787 GHSA-cwm8-xj6v-vqwj: An issue was discovered in OpenEXR before 2
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
OSV
openexr vulnerabilities
osv·2020-04-27·CVSS 8.8
CVE-2017-9111 [HIGH] openexr vulnerabilities
openexr vulnerabilities
Brandon Perry discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR image
file, a remote attacker could cause a denial of service, or possibly
execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)
Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 20.04 LTS.
(CVE-2018-18444)
Samuel Groß discovered that OpenEXR incorrectly handled certain malformed
EXR image files. If a user were tricked into opening a crafted EXR i
OSV
thunderbird vulnerabilities
osv·2020-04-21·CVSS 8.8
CVE-2019-11757 thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, bypass
same-origin restrictions, conduct cross-site scripting (XSS) attacks, or
execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759,
CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763,
CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010,
CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017,
CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503,
CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,
CVE-2020
OSV
CVE-2020-11764: An issue was discovered in OpenEXR before 2
osv·2020-04-14·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764: An issue was discovered in OpenEXR before 2
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
Project0
Fuzzing ImageIO - Project Zero
project_zero·2020-04-01
CVE-2020-11758 Fuzzing ImageIO - Project Zero
Posted by Samuel Groß, Project Zero
This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost.
To reiterate an important point, the vulnerabilities described throughout this blog are reachable through popular messengers but are not part of their codebase.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-11764 hadoop: privilege escalation in web endpoint
bugzilla·2020-10-21·CVSS 8.8
CVE-2018-11764 [HIGH] CVE-2018-11764 hadoop: privilege escalation in web endpoint
CVE-2018-11764 hadoop: privilege escalation in web endpoint
A flaw was found in Apache Hadoop. Web endpoint authentication check is broken. Authenticated users may impersonate any user even if no proxy user is configured.
Reference:
https://www.openwall.com/lists/oss-security/2020/10/21/1
Discussion:
OpenShift is using Hadoop 3.1.1 which is not affected by this issue.
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2018-11764
Bugzilla
CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020
Discussion:
Created OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1828991]
Created mingw-OpenEXR tracking bugs for this issue:
Affects: fedora-all [bug 1828992]
---
Mitigation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread in
Bugzilla
CVE-2020-11764 mingw-OpenEXR: OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764 mingw-OpenEXR: OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
CVE-2020-11764 mingw-OpenEXR: OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
bugzilla·2020-04-28·CVSS 5.5
CVE-2020-11764 [MEDIUM] CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects m
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1987https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1https://lists.debian.org/debian-lts-announce/2020/08/msg00056.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/https://security.gentoo.org/glsa/202107-27https://support.apple.com/kb/HT211288https://support.apple.com/kb/HT211289https://support.apple.com/kb/HT211290https://support.apple.com/kb/HT211291https://support.apple.com/kb/HT211293https://support.apple.com/kb/HT211294https://support.apple.com/kb/HT211295https://usn.ubuntu.com/4339-1/https://www.debian.org/security/2020/dsa-4755http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1987https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1https://lists.debian.org/debian-lts-announce/2020/08/msg00056.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/https://security.gentoo.org/glsa/202107-27https://support.apple.com/kb/HT211288https://support.apple.com/kb/HT211289https://support.apple.com/kb/HT211290https://support.apple.com/kb/HT211291https://support.apple.com/kb/HT211293https://support.apple.com/kb/HT211294https://support.apple.com/kb/HT211295https://usn.ubuntu.com/4339-1/https://www.debian.org/security/2020/dsa-4755
2020-04-14
Published