Multiple vulnerabilities has been found and corrected in OpenEXR :

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information (CVE-2009-1720).

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer (CVE-2009-1721).

Buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2009-1722).

This update provides fixes for these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

OpenEXR イメージライブラリに、任意のコードの実行を引き起こす可能性がある複数の脆弱性が発見されました。Common Vulnerabilities and Exposures プロジェクトは次の問題を特定しています：

- CVE-2009-1720 Drew Yao 氏は、プレビューおよび圧縮コードに整数オーバーフローがあることを発見しました。

- CVE-2009-1721 Drew Yao 氏は、展開コードで初期化されていないポインターが解放される可能性があることを発見しました。

- CVE-2009-1722 圧縮コードに、バッファオーバーフローが発見されました。

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.8. 

Mac OS X 10.5.8 contains security fixes for the following products :

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launchd
  - Login Window
  - MobileMe
  - Networking
  - XQuery

Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1720     Drew Yao discovered integer overflows in the preview and     compression code.

  - CVE-2009-1721     Drew Yao discovered that an uninitialised pointer could     be freed in the decompression code.

  - CVE-2009-1722     A buffer overflow was discovered in the compression     code.

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-003 applied.

This security update contains fixes for the following products :

  - bzip2
  - ColorSync
  - ImageIO
  - Login Window

Drew Yao discovered several flaws in the way OpenEXR handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1720, CVE-2009-1721)

It was discovered that OpenEXR did not properly handle certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-1722).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.8.  Mac OS X 10.5.8 contains security fixes for the following products : 

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launched
  - Login Window
  - MobileMe
  - Networking
  - XQuery

ID	名稱	產品	系列	已發布	已更新	嚴重性
43075	Mandriva Linux Security Advisory : OpenEXR (MDVSA-2009:191-1)	Nessus	Mandriva Local Security Checks	2009/12/9	2021/1/6	high
44707	Debian DSA-1842-1：openexr - いくつかの脆弱性	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
40502	Mac OS X 10.5.x < 10.5.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/8/5	2024/5/28	critical
44707	Debian DSA-1842-1 : openexr - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
40501	Mac OS X Multiple Vulnerabilities (Security Update 2009-003)	Nessus	MacOS X Local Security Checks	2009/8/5	2024/5/28	critical
40982	Ubuntu 8.04 LTS / 8.10 / 9.04 : openexr vulnerabilities (USN-831-1)	Nessus	Ubuntu Local Security Checks	2009/9/15	2021/1/19	high
5122	Mac OS X 10.5 < 10.5.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2009/8/6	2019/3/6	critical

偵測

搜尋 Plugin

high

high

critical

high

critical

high

critical