このopenexrの更新では、次の問題が修正されます：

CVE-2017-14988：Headerでサービス拒否を修正しました：: readfrom()（bsc#1061305）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 OpenEXR 2.2.0 中，IlmImf/ImfHeader.cpp 中的 Header::readfrom 允許遠端攻擊者透過使用 IlmImf/ImfCRgbaFile.cpp 中的 ImfOpenInputFile 函式存取的特製檔案，造成拒絕服務 (過度記憶體配置)。注意：維護者和多個第三方認為此弱點無效 (CVE-2017-14988)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - OpenEXR 2.2.0 中，IlmImf/ImfHeader.cpp 中的 Header::readfrom 允许远程攻击者通过可使用 IlmImf/ImfCRgbaFile.cpp 中的 ImfOpenInputFile 函数访问的构建文件造成拒绝服务（过量内存分配）。注意：维护者和多个第三方认为此漏洞无效 (CVE-2017-14988)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

This update for openexr fixes the following issues :

CVE-2017-14988: Fixed a denial of service in Header::readfrom() (bsc#1061305).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR     2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted     file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The     maintainer and multiple third parties believe that this     vulnerability isn't valid.(CVE-2017-14988)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     getBits function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9112)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     refill function in ImfFastHuf.cpp could cause the     application to crash.(CVE-2017-9114)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     uncompress function in ImfZip.cpp could cause the     application to crash.(CVE-2017-9116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - OpenEXR 2.2.0 の IlmImf/ImfHeader.cpp の Header::readfrom により、リモートの攻撃者が、IlmImf/ImfCRgbaFile.cpp の ImfOpenInputFile 関数でアクセスされる細工されたファイルを介して、サービス拒否 (過剰なメモリ割り当て) を引き起こすことが可能です。注意: メンテナーおよび複数のサードパーティは、この脆弱性は有効ではないと考えています (CVE-2017-14988)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - OpenEXR is a high dynamic-range (HDR) image file format     developed by Industrial Light & Magic for use in     computer imaging applications. This package contains     libraries and sample applications for handling the     format.Security Fix(es):In OpenEXR 2.2.0, an invalid     write of size 2 in the = operator function in half.h     could cause the application to crash or execute     arbitrary code.(CVE-2017-9115)In OpenEXR 2.2.0, an     invalid write of size 8 in the storeSSE function in     ImfOptimizedPixelReading.h could cause the application     to crash or execute arbitrary code.(CVE-2017-9111)In     OpenEXR 2.2.0, a crafted image causes a heap-based     buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution it may     result in denial of service or possibly unspecified     other impact.(CVE-2017-12596)In OpenEXR 2.2.0, an     invalid write of size 1 in the bufferedReadPixels     function in ImfInputFile.cpp could cause the     application to crash or execute arbitrary     code.(CVE-2017-9113)In OpenEXR 2.2.0, an invalid read     of size 1 in the uncompress function in ImfZip.cpp     could cause the application to crash.(CVE-2017-9116)In     OpenEXR 2.2.0, an invalid read of size 1 in the refill     function in ImfFastHuf.cpp could cause the application     to crash.(CVE-2017-9114)In OpenEXR 2.2.0, an invalid     read of size 1 in the getBits function in ImfHuf.cpp     could cause the application to crash.(CVE-2017-9112)In     OpenEXR 2.2.0, an invalid read of size 2 in the     hufDecode function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9110)Header::readfrom in     IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote     attackers to cause a denial of service (excessive     memory allocation) via a crafted file that is accessed     with the ImfOpenInputFile function in     IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and     multiple third parties believe that this vulnerability     isn't valid.(CVE-2017-14988)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openexr fixes the following issues :

  - CVE-2017-14988: Fixed a denial of service in     Header::readfrom() (bsc#1061305).

This update was imported from the SUSE:SLE-15:Update update project.

このopenexrの更新では、次の問題が修正されます：

  - CVE-2017-14988：Headerでサービス拒否を修正しました：: readfrom()（bsc#1061305）。

この更新はSUSEからインポートされました：SLE-15：更新プロジェクトを更新します。

ID	名稱	產品	系列	已發布	已更新	嚴重性
127754	SUSE SLED12 / SLES12セキュリティ更新プログラム：openexr（SUSE-SU-2019:2014-1）	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
220581	Linux Distros 未修補弱點：CVE-2017-14988	Nessus	Misc.	2025/3/4	2025/9/14	medium
220581	Linux Distros 未修补的漏洞: CVE-2017-14988	Nessus	Misc.	2025/3/4	2025/9/14	medium
127763	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2019:2043-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
220581	Linux Distros Unpatched Vulnerability : CVE-2017-14988	Nessus	Misc.	2025/3/4	2025/9/14	medium
127754	SUSE SLED12 / SLES12 Security Update : openexr (SUSE-SU-2019:2014-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
135545	EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2020-1416)	Nessus	Huawei Local Security Checks	2020/4/15	2021/1/6	medium
127763	SUSE SLED15 / SLES15セキュリティ更新プログラム：openexr（SUSE-SU-2019:2043-1）	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
220581	Linux Distros のパッチ未適用の脆弱性: CVE-2017-14988	Nessus	Misc.	2025/3/4	2025/9/14	medium
136862	EulerOS 2.0 SP8 : OpenEXR (EulerOS-SA-2020-1584)	Nessus	Huawei Local Security Checks	2020/5/26	2024/3/8	high
128016	openSUSE Security Update : openexr (openSUSE-2019-1954)	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	medium
128016	openSUSEセキュリティ更新プログラム：openexr（openSUSE-2019-1954）	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium