CVE-2017-9115: High severity OpenEXR OpenEXR vulnerability
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openexrto a version that resolves this vulnerability.Fixed in 3.1.5-5Fixed in 3.1.13-2Fixed in 3.4.16+ds-1
Event History
Frequently Asked Questions
What is CVE-2017-9115?
CVE-2017-9115 is a vulnerability in OpenEXR 2.2.0 that could cause the application to crash or execute arbitrary code.
How severe is CVE-2017-9115?
CVE-2017-9115 has a severity of 8.8 (high).
How can I fix CVE-2017-9115?
To fix CVE-2017-9115, update OpenEXR to version 2.2.1-4.1+deb10u1 or higher, 2.2.1-4.1ubuntu0.1 or higher, 2.3.0-6ubuntu0.1 or higher, 2.2.0-10ubuntu2.1 or higher, or 2.2.0-11.1ubuntu1.1 or higher.
Where can I find more information about CVE-2017-9115?
You can find more information about CVE-2017-9115 at the following links: [1] [2] [3].
Which software is affected by CVE-2017-9115?
OpenEXR versions 2.2.0, 2.2.1, 2.3.0, and 3.1.5 are affected by CVE-2017-9115.