CVE-2018-20652: Medium severity tinyexr vulnerability

Published Jan 1, 2019

Updated

An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted input, which leads to an out-of-memory exception.

Affected Software

1 affected component

Tinyexr Project Tinyexr=0.9.5

Event History

Jan 1, 2019

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is CVE-2018-20652?

CVE-2018-20652 is a vulnerability in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5.

How does CVE-2018-20652 impact users?

CVE-2018-20652 allows remote attackers to cause a denial-of-service through a crafted input, leading to an out-of-memory exception.

Is there a fix for CVE-2018-20652?

Yes, updating to a version higher than v0.9.5 of tinyexr fixes the vulnerability.

What is the severity of CVE-2018-20652?

The severity of CVE-2018-20652 is medium, with a severity value of 6.5.

Where can I find more information about CVE-2018-20652?

You can find more information about CVE-2018-20652 at the following link: [GitHub Issue](https://github.com/syoyo/tinyexr/issues/104)