Heap-based buffer overflow in OpenEXR - CVE-2020-15306

Vulnerability identifier: #VU31715

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15306

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in "getChunkOffsetTableSize()" in "IlmImf/ImfMisc.cpp". A local user can pass specially crafted data to the applicatoin, trigger heap-based buffer overflow and cause a denial of service conditon on the target system.

OpenEXR
Gentoo Linux
Opensuse
Ubuntu
openEuler
Fedora
openexr (Alpine package)
openexr (Debian package)
openexr (Ubuntu package)
libopenexr22 (Ubuntu package)
OpenEXR
OpenEXR-debuginfo
OpenEXR-devel
OpenEXR-libs
OpenEXR-debugsource
libopenexr23 (Ubuntu package)
mingw-openexr
libopenexr24 (Ubuntu package)

Install updates from vendor's website.

OpenEXR - update to 2.5.2
openexr (Debian package) - update to 2.2.1-4.1+deb10u1
openexr (Ubuntu package) - addressed in versions 2.2.0-10ubuntu2.3, 2.2.0-11.1ubuntu1.3, 2.2.1-4.1ubuntu1.2, 2.3.0-6ubuntu0.2
libopenexr22 (Ubuntu package) - addressed in versions 2.2.0-10ubuntu2.3, 2.2.0-11.1ubuntu1.3
OpenEXR - update to 2.2.0-22
OpenEXR-debuginfo - update to 2.2.0-22
OpenEXR-devel - update to 2.2.0-22
OpenEXR-libs - update to 2.2.0-22
OpenEXR-debugsource - update to 2.2.0-22
libopenexr23 (Ubuntu package) - update to 2.2.1-4.1ubuntu1.2
mingw-openexr - addressed in versions 2.3.0-4.fc31, 2.4.1-2.fc32
libopenexr24 (Ubuntu package) - update to 2.3.0-6ubuntu0.2

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html
• https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
• https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md
• https://github.com/AcademySoftwareFoundation/openexr/pull/738
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKDRVXORM2VLNHRLFKS3JHRABSHZ5W5M/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SHYAKRAUEMYVCV7U5WLDRE2YFGSV5PIT/
• https://usn.ubuntu.com/4418-1/

• Multiple vulnerabilities in OpenEXR
• OpenSUSE Linux update for openexr
• OpenSUSE Linux update for openexr
• Heap-based buffer overflow in openexr (Alpine package)
• Debian update for openexr
• Gentoo update for OpenEXR
• openEuler 20.03 LTS SP1 update for OpenEXR
• Ubuntu update for openexr
• Fedora 32 update for mingw-OpenEXR
• Fedora 31 update for mingw-OpenEXR