REDHAT-BUG-2455411: High severity OpenEXR OpenEXR vulnerability
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder constructs temporary per-component block pointers using signed 32-bit arithmetic. For a large enough width, the calculation overflows and later decoder stores operate on a wrapped pointer outside the allocated rowBlock backing store. This vulnerability is fixed in 3.2.7, 3.3.9, and 3.4.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXR DWA lossy decoderto a version that resolves this vulnerability.Fixed in 3.2.7 - Upgrade
Upgrade
OpenEXR DWA lossy decoderto a version that resolves this vulnerability.Fixed in 3.3.9 - Upgrade
Upgrade
OpenEXR DWA lossy decoderto a version that resolves this vulnerability.Fixed in 3.4.9
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455411?
The severity of REDHAT-BUG-2455411 is high, rated at 7.
How do I fix REDHAT-BUG-2455411?
To fix REDHAT-BUG-2455411, update OpenEXR to version 3.2.7 or later, 3.3.9 or later, or 3.4.9 or later.
What versions of OpenEXR are affected by REDHAT-BUG-2455411?
OpenEXR versions from 3.2.0 up to but not including 3.2.7, as well as 3.3.9 and 3.4.9 are affected by REDHAT-BUG-2455411.
What type of vulnerability is REDHAT-BUG-2455411?
REDHAT-BUG-2455411 is a vulnerability related to the DWA lossy decoder in OpenEXR.
What are the risks associated with REDHAT-BUG-2455411?
The risks associated with REDHAT-BUG-2455411 include potential exploitation through improper handling of image files in affected versions.