CVE-2017-14988: Medium severity OpenEXR OpenEXR vulnerability

Published Oct 2, 2017

Updated

DISPUTED Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid.

Affected Software

1 affected component

OpenEXR OpenEXR=2.2.0

Event History

Oct 2, 2017

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Oct 3, 2017

Disputed

01:29 AM

Frequently Asked Questions

What is the severity of CVE-2017-14988?

CVE-2017-14988 is considered a denial of service vulnerability due to excessive memory allocation.

How do I fix CVE-2017-14988?

To resolve CVE-2017-14988, you should upgrade to a version of OpenEXR that addresses this vulnerability.

Which version of OpenEXR is affected by CVE-2017-14988?

CVE-2017-14988 specifically affects OpenEXR version 2.2.0.

Can CVE-2017-14988 be exploited remotely?

Yes, CVE-2017-14988 can be exploited remotely through crafted files processed by the ImfOpenInputFile function.

What components of OpenEXR are involved in CVE-2017-14988?

The vulnerability in CVE-2017-14988 is primarily associated with IlmImf/ImfHeader.cpp and IlmImf/ImfCRgbaFile.cpp.