Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

OpenEXR may cause program crashes from malformed data

published 6 years ago
Summary

The OpenEXR image library, version 2.3.0-6, can mishandle specially crafted files and cause the program using it to stop working. This could interrupt services that rely on image processing. Update OpenEXR to version 2.5.2 or later to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure openexr <= 2.3.0-6
Original advisory text
CVE-2020-15306 affecting package OpenEXR 2.3.0-6
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Timeline
Published26 Jun 2020
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45069 · OSV
Track software like this
Free during beta