CVE-2021-23169
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-23169
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23169.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-23169
- Related
- Published
- 2021-06-08T12:15:10Z
- Modified
- 2025-01-14T08:50:05.230322Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
- References
-
- https://security.gentoo.org/glsa/202210-31
- https://bugzilla.redhat.com/show_bug.cgi?id=1947612
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KYNJSMVA6YJY5NMKDZ5SAISKZG2KCKC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/
- https://security-tracker.debian.org/tracker/CVE-2021-23169
Affected packages
Debian:11 / openexr
Package
- Name
- openexr
- Purl
- pkg:deb/debian/openexr?arch=source
Debian:12 / openexr
Package
- Name
- openexr
- Purl
- pkg:deb/debian/openexr?arch=source
Debian:13 / openexr
Package
- Name
- openexr
- Purl
- pkg:deb/debian/openexr?arch=source