Heap-Based Buffer Overflow Vulnerability in OpenEXR Package
Summary
DEBIAN-CVE-2023-5841: Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-bas... Affects openexr versions < 3.1.13-1. Fixed in 3.1.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source image file format developed by the Academy Software Foundation, designed for high dynamic range (HDR) images. It is widely used in visual effects and computer graphics due to its ability to store multiple layers and channels of image data. The package is integral for applications requiring advanced image processing capabilities. However, it has been found to be vulnerable to a heap-based buffer overflow due to improper validation of scanline samples in deep scanline data.
Vulnerability Detail
The vulnerability arises from a failure in the OpenEXR library to validate the number of scanline samples in files containing deep scanline data. This oversight can lead to a heap-based buffer overflow, which may allow an attacker to execute arbitrary code, potentially compromising the integrity and security of the system. The affected versions are 3.2.1 and prior, with the issue resolved in versions 3.2.2 and 3.1.12.
How To Fix
Minimum fixed version
3.1.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openexrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version of the OpenEXR package.
Conclusion
The OpenEXR package has a critical vulnerability due to a heap-based buffer overflow stemming from inadequate validation of scanline samples. Users are strongly advised to update to the patched version to mitigate potential security risks. Utilizing tools like Vulert can help in monitoring and identifying such vulnerabilities in real-time.
See every vulnerability recorded for openexr →
FAQ
A heap-based buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to erratic program behavior or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Failing to address this vulnerability could allow attackers to exploit the buffer overflow, leading to unauthorized access, data corruption, or system compromise.
The vulnerability affects the OpenEXR package across Debian 13 and 14, but similar issues may exist in other operating systems if they use the vulnerable versions of the library.
More information about OpenEXR can be found on the Academy Software Foundation's official website and its documentation, which provides insights into its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
