Bug 13914

Please patch CVEs for package openexr version 2.5.8
  
INFO (CVEs are): openexr 2.5.8
 cves found
CVE-2021-23169
Desc: A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-23169
Severity: HIGH
CVE-2021-23215
Desc: An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-23215
Severity: MEDIUM
CVE-2021-26260
Desc: An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-26260
Severity: MEDIUM
CVE-2021-26945
Desc: An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-26945
Severity: MEDIUM
CVE-2021-3474
Desc: There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3474
Severity: MEDIUM
CVE-2021-3475
Desc: There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer overflow, potentially leading to problems with application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3475
Severity: MEDIUM
CVE-2021-3476
Desc: A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3476
Severity: MEDIUM
CVE-2021-3477
Desc: There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3477
Severity: MEDIUM
CVE-2021-3478
Desc: There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3478
Severity: MEDIUM
CVE-2021-3479
Desc: There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3479
Severity: MEDIUM
CVE-2021-3598
Desc: There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3598
Severity: MEDIUM
CVE-2021-3605
Desc: There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3605
Severity: MEDIUM
CVE-2021-3933
Desc: An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3933
Severity: MEDIUM