CVE-2018-12092: Critical severity tinyexr vulnerability
Published Jun 11, 2018
·Updated
tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
Affected Software
1 affected component
Tinyexr Project Tinyexr=0.9.5
Event History
Jun 11, 2018
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is CVE-2018-12092?
CVE-2018-12092 is a vulnerability in tinyexr 0.9.5 that allows for a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h.
2
How severe is CVE-2018-12092?
CVE-2018-12092 has a severity rating of 9.8, which is classified as critical.
3
What software versions are affected by CVE-2018-12092?
Version 0.9.5 of Tinyexr Project Tinyexr is affected by CVE-2018-12092.
4
How can I fix CVE-2018-12092?
To fix CVE-2018-12092, update to a version of tinyexr that is not affected by the vulnerability.
5
Where can I find more information about CVE-2018-12092?
More information about CVE-2018-12092 can be found at the following reference: https://github.com/syoyo/tinyexr/issues/78