CVE-2022-38529: Buffer Overflow
tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tinyexrto a version that resolves this vulnerability.Fixed in 1.0.1+dfsg-4Fixed in 1.0.10+dfsg-1Fixed in 1.0.13+dfsg-2 - Upgrade
Upgrade
debian/tinyexrto a version that resolves this vulnerability.Fixed in 1.0.1+dfsg-4
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-38529.
What is the severity of CVE-2022-38529?
The severity of CVE-2022-38529 is high, with a severity value of 7.8.
What software is affected by CVE-2022-38529?
The Tinyexr software, specifically the version released on June 28, 2022 (commit 0647fb3), is affected by CVE-2022-38529.
How does CVE-2022-38529 manifest?
CVE-2022-38529 manifests as a heap-buffer overflow through the component rleUncompress in Tinyexr.
Is there a patch or fix available for CVE-2022-38529?
At the time of writing, there is no specific patch or fix available for CVE-2022-38529. It is recommended to monitor the official GitHub repository for any updates or mitigation strategies.