CVE-2021-20296: Null Pointer Dereference
A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
Other sources
Segv on unknown address in Imf25::hufUncompress
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2021-20296.
What is the severity of CVE-2021-20296?
The severity of CVE-2021-20296 is medium, with a CVSS score of 5.3.
Which software versions are affected by CVE-2021-20296?
Versions before 3.0.0-beta of OpenEXR are affected by CVE-2021-20296.
What is the impact of CVE-2021-20296?
The highest threat from CVE-2021-20296 is to system availability.
Are there any references for CVE-2021-20296?
Yes, you can find references for CVE-2021-20296 at the following links: [Link 1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854), [Link 2](https://bugzilla.redhat.com/show_bug.cgi?id=1939141), [Link 3](https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html).