CVE-2022-34300: High severity Tinyexr Project Tinyexr vulnerability
Published Jun 22, 2022
·Updated
In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.
Affected Software
5 affected componentsFixes available
Tinyexr Project Tinyexr=1.0.1
debian/tinyexr<1.0.1+dfsg-4
1.0.1+dfsg-4
debian/tinyexr<1.0.1+dfsg-4
1.0.1+dfsg-4
debian/tinyexr<1.0.1+dfsg-4
1.0.1+dfsg-4
debian/tinyexr
1.0.1+dfsg-41.0.10+dfsg-11.0.13+dfsg-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tinyexrto a version that resolves this vulnerability.Fixed in 1.0.1+dfsg-4Fixed in 1.0.10+dfsg-1Fixed in 1.0.13+dfsg-2 - Upgrade
Upgrade
debian/tinyexrto a version that resolves this vulnerability.Fixed in 1.0.1+dfsg-4
Event History
Jun 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Jun 23, 2022
Data Sourced
via OSV·05:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2022-34300?
CVE-2022-34300 is a vulnerability in tinyexr 1.0.1 that allows for a heap-based buffer over-read in tinyexr::DecodePixelData.
2
What is the severity of CVE-2022-34300?
CVE-2022-34300 has a severity rating of 8.8 (high).
3
How does CVE-2022-34300 affect the software?
CVE-2022-34300 affects tinyexr 1.0.1.
4
How can I fix CVE-2022-34300?
To fix CVE-2022-34300, you should update to a version of tinyexr that is not affected by this vulnerability.
5
Where can I find more information about CVE-2022-34300?
You can find more information about CVE-2022-34300 in the following references: [link1], [link2], [link3].