The remote host is affected by the vulnerability described in GLSA-202107-27 (OpenEXR: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenEXR. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in OpenEXR before 2.4.1. There     is an out-of-bounds write in copyIntoFrameBuffer in     ImfMisc.cpp.(CVE-2020-11764)

  - An issue was discovered in OpenEXR before 2.4.1. There     is an std::vector out-of-bounds read and write, as     demonstrated by ImfTileOffsets.cpp.(CVE-2020-11763)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)

Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. (CVE-2018-18444)

Samuel Gross discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2020-11758, CVE-2020-11759, CVE-2020-11760, CVE-2020-11761, CVE-2020-11762, CVE-2020-11763, CVE-2020-11764)

It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service.
(CVE-2020-11765).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4039 advisory.

  - OpenEXR: out-of-bounds read during Huffman uncompression (CVE-2020-11761)

  - OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp (CVE-2020-11763)

  - OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp (CVE-2020-11764)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenEXR: out-of-bounds read during Huffman uncompression     (CVE-2020-11761)

  - OpenEXR: std::vector out-of-bounds read and write in     ImfTileOffsets.cpp (CVE-2020-11763)

  - OpenEXR: out-of-bounds write in copyIntoFrameBuffer     function in ImfMisc.cpp (CVE-2020-11764)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer (CVE-2021-23169)

  - OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

  - OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by     exrmultiview. (CVE-2018-18443)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
157033	GLSA-202107-27 : OpenEXR: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2024/1/16	medium
149143	EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2021-1822)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	medium
136028	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenEXR vulnerabilities (USN-4339-1)	Nessus	Ubuntu Local Security Checks	2020/4/28	2023/10/20	high
141592	CentOS 7 : OpenEXR (CESA-2020:4039)	Nessus	CentOS Local Security Checks	2020/10/20	2024/2/15	medium
141748	Scientific Linux Security Update : OpenEXR on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	medium
199439	RHEL 8 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical

偵測

搜尋 Plugin

medium

medium

high

medium

medium

critical