REDHAT-BUG-2467633: High severity OpenEXR vulnerability
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.9 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.11 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.11
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2467633?
The severity of REDHAT-BUG-2467633 is classified as high with a rating of 7.
How do I fix REDHAT-BUG-2467633?
To fix REDHAT-BUG-2467633, update OpenEXR to version 3.2.9 or later, 3.3.11 or later, or 3.4.11 or later.
What versions are affected by REDHAT-BUG-2467633?
Versions of OpenEXR from 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11 are affected by REDHAT-BUG-2467633.
What type of vulnerability is REDHAT-BUG-2467633?
REDHAT-BUG-2467633 is associated with a vulnerability in the IDManifest::init() function of OpenEXR that can lead to string reconstruction issues.
What is the impact of REDHAT-BUG-2467633?
The impact of REDHAT-BUG-2467633 includes potential exploitation that could affect image processing in applications using the OpenEXR file format.