CVE-2021-20299: Null Pointer Dereference
A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
Other sources
Null-dereference READ in Imf25::Header::operator
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20299?
CVE-2021-20299 is a vulnerability found in OpenEXR's Multipart input file functionality that can trigger a NULL pointer dereference and lead to system availability issues.
What is the severity of CVE-2021-20299?
The severity of CVE-2021-20299 is high, with a severity value of 7.5.
What software is affected by CVE-2021-20299?
OpenEXR versions up to and excluding 2.5.4, Debian Linux version 10.0, and Red Hat OpenEXR version up to and excluding 3.0.0 are affected by CVE-2021-20299.
How can CVE-2021-20299 be exploited?
CVE-2021-20299 can be exploited by using a crafted multi-part input file with no actual parts.
How can I fix CVE-2021-20299?
To fix CVE-2021-20299, update to OpenEXR version 2.5.4 or later, Debian Linux version 10.0 or later, or Red Hat OpenEXR version 3.0.0 or later.