Heap-based buffer overflow in OpenEXR - CVE-2023-5841

Vulnerability identifier: #VU86235

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2023-5841

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
OpenEXR
Amazon Linux AMI
visionOS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
tvOS
openEuler
Anolis OS
Fedora
macOS
iPadOS
Apple iOS
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
OpenEXR (Red Hat package)
openexr
OpenEXR-debuginfo
OpenEXR-libs
OpenEXR-devel
OpenEXR-debugsource
OpenEXR
OpenEXR-doc
mingw-openexr

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when validating the number of scanline samples of a OpenEXR file containing deep scanline data. A remote attacker can pass specially crafted file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

• https://takeonme.org/cves/CVE-2023-5841.html
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.1.12
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.2