CVE-2021-20302: Input Validation
Published Mar 15, 2021
·Updated
A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
Other sources
Floating-point-exception in Imf25::precalculateTileInfot
— Red Hat
Affected Software
3 affected componentsFixes available
redhat/OpenEXR<2.5.4
2.5.4
OpenEXR OpenEXR<2.5.4
Debian Debian Linux=10.0
Remediation
Patch Available
Patch Available
Event History
Mar 15, 2021
Data Sourced
via Red Hat·05:27 PM
DescriptionSeverityAffected Software
Mar 4, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this OpenEXR flaw?
The vulnerability ID of this OpenEXR flaw is CVE-2021-20302.
2
What is the severity of CVE-2021-20302?
The severity of CVE-2021-20302 is high with a severity value of 5.5.
3
How does the OpenEXR flaw affect system availability?
The OpenEXR flaw can cause a floating-point exception error, which can impact system availability.
4
Which software versions are affected by CVE-2021-20302?
Versions up to and excluding 2.5.4 of OpenEXR and 10.0 of Debian Debian Linux are affected by CVE-2021-20302.
5
Is there a fix available for CVE-2021-20302?
Yes, a fix for CVE-2021-20302 is available in version 2.5.4 of OpenEXR.