CVE-2021-3941: Divide by Zero
Published Nov 3, 2021
·Updated
A vulnerability was found in openexr where a Divide-by-zero was found in Imf31::RGBtoXYZ.
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39084
Other sources
In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as float Z = (1 - chroma.white.x - chroma.white.y) Y / chroma.white.y; and chroma.green.y (X + Z))) / d; but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.
Affected Software
11 affected componentsFixes available
debian/openexr<=2.2.1-4.1+deb10u1
2.2.1-4.1+deb10u22.5.4-2+deb11u13.1.5-53.1.5-5.1
redhat/OpenEXR<3.1.2
3.1.2
OpenEXR OpenEXR=3.1.2
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Remediation
Patch Available
Event History
Nov 3, 2021
Data Sourced
via Red Hat·10:59 AM
DescriptionSeverityAffected Software
Mar 25, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness