Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-50245: OpenEXR-viewer can crash before version 0.6.1
CVE-2023-50245 · published 2 years ago
Summary
Versions of OpenEXR-viewer released before 0.6.1 can run out of memory, which may cause the program to stop working or be taken over by an attacker. The problem is fixed in version 0.6.1. Upgrade to version 0.6.1 or later to eliminate the risk.
What to do
- Update afichet openexr-viewer to version 0.6.1.
- Update afichet openexr_viewer to version 0.6.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| actions | afichet | openexr-viewer |
< 0.6.1 Fix: upgrade to 0.6.1
|
| – | afichet | openexr_viewer |
< 0.6.1 cpe:2.3:a:afichet:openexr_viewer:*:*:*:*:*:*:*:* |
Original advisory text
OpenEXR-viewer memory overflow vulnerability
OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.
References
- https://github.com/advisories/GHSA-99jg-r3f4-rpxj
- https://github.com/afichet/openexr-viewer/security/advisories/GHSA-99jg-r3f4-rpx... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-50245 Vendor Advisory
- https://github.com/afichet/openexr-viewer/commit/d0a7e85dfeb519951fb8a8d70f73f30... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50245... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-120Classic Buffer Overflow
Timeline
Published11 Dec 2023
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta