CVE-2017-9110
First published: Sun May 21 2017(Updated: )
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openexr Openexr | =2.2.0 | |
| debian/openexr | 2.5.4-2+deb11u1 3.1.5-5 3.1.5-5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2017/05/12/5
- https://github.com/openexr/openexr/issues/232
- https://github.com/openexr/openexr/pull/233
- https://github.com/openexr/openexr/releases/tag/v2.2.1
- https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html
- https://usn.ubuntu.com/4148-1/
- https://launchpad.net/bugs/cve/CVE-2017-9110
- https://www.openwall.com/lists/oss-security/2017/05/12/5
- https://github.com/AcademySoftwareFoundation/openexr/commit/49db4a4192482eec9c27669f75db144cf5434804
- https://security-tracker.debian.org/tracker/CVE-2017-9110
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9110
- https://nvd.nist.gov/vuln/detail/CVE-2017-9110
- https://ubuntu.com/security/CVE-2017-9110
Frequently Asked Questions
What is CVE-2017-9110?
CVE-2017-9110 is a vulnerability in OpenEXR 2.2.0 that can cause an application to crash due to an invalid read of size 2 in the hufDecode function in ImfHuf.cpp.
How severe is CVE-2017-9110?
CVE-2017-9110 has a severity rating of medium with a score of 6.5.
How can CVE-2017-9110 be exploited?
CVE-2017-9110 can be exploited by causing the application to process a specially crafted image file that triggers the invalid read in the hufDecode function.
Is OpenEXR 2.2.0 the only affected version?
Yes, OpenEXR 2.2.0 is the only affected version of the software.
Is there a fix available for CVE-2017-9110?
Yes, a fix for CVE-2017-9110 is available in the form of a patch that can be applied to OpenEXR 2.2.0.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/event
- agent/description
- agent/severity
- agent/remedy
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/openexr
- canonical/openexr openexr
- version/openexr openexr/2.2.0
- package-manager/debian