Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-11762: OpenEXR can access memory it shouldn't

CVE-2020-11762 · published 6 years ago

Summary

Versions of OpenEXR older than 2.4.1 have a coding error in the part that handles unknown compression types. This error can cause the program to read or write data outside the area it is supposed to, which may lead to crashes or allow a crafted file to behave unexpectedly. Update OpenEXR to version 2.4.1 or later to fix the issue.

What to do

Update debian openexr to version 2.5.3-2.
Update openexr openexr to version 2.4.1 or later.
Update apple itunes to version 12.10.8 or later.
Update apple ipados to version 13.6 or later.
Update apple iphone_os to version 13.6 or later.
Update apple tvos to version 13.4.8 or later.
Update apple watchos to version 6.2.8 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	openexr	< 2.5.3-2 Fix: upgrade to 2.5.3-2
Debian:13	debian	openexr	< 2.5.3-2 Fix: upgrade to 2.5.3-2
Debian:14	debian	openexr	< 2.5.3-2 Fix: upgrade to 2.5.3-2
–	openexr	openexr	< 2.4.1 `cpe:2.3:a:openexr:openexr::::::::`
–	fedoraproject	fedora	32 `cpe:2.3:o:fedoraproject:fedora:32:::::::*`
–	canonical	ubuntu_linux	16.04 18.04 19.10 20.04 `cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::`
–	opensuse	leap	15.1 `cpe:2.3:o:opensuse:leap:15.1:::::::*`
–	debian	debian_linux	9.0 10.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`
–	apple	icloud	< 7.20 >= 10.0, < 11.3 `cpe:2.3:a:apple:icloud::::::windows::*`
–	apple	itunes	< 12.10.8 `cpe:2.3:a:apple:itunes::::::windows::*`
–	apple	ipados	< 13.6 `cpe:2.3:o:apple:ipados::::::::`
–	apple	iphone_os	< 13.6 `cpe:2.3:o:apple:iphone_os::::::::`
–	apple	mac_os_x	< 10.15.6 >= 10.13.0, < 10.13.6 >= 10.14.0, < 10.14.6 10.13.6 10.14.6 `cpe:2.3:o:apple:mac_os_x::::::::`
–	apple	tvos	< 13.4.8 `cpe:2.3:o:apple:tvos::::::::`
–	apple	watchos	< 6.2.8 `cpe:2.3:o:apple:watchos::::::::`

Original advisory text

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.

References

https://security-tracker.debian.org/tracker/CVE-2020-11762 Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202107-27 Third Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1987 Exploit Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#vers... Release Notes Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1 Release Notes Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://support.apple.com/kb/HT211288 Third Party Advisory
https://support.apple.com/kb/HT211289 Third Party Advisory
https://support.apple.com/kb/HT211290 Third Party Advisory
https://support.apple.com/kb/HT211291 Third Party Advisory
https://support.apple.com/kb/HT211293 Third Party Advisory
https://support.apple.com/kb/HT211294 Third Party Advisory
https://support.apple.com/kb/HT211295 Third Party Advisory
https://usn.ubuntu.com/4339-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4755 Third Party Advisory

Severity

5.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-787Out-of-bounds Write

Timeline

Published14 Apr 2020

Updated3 Nov 2026

First seen11 Sep 2026

Sources

DEBIAN-CVE-2020-11762 · OSV

CVE-2020-11762 · NVD

Track software like this

Free during beta