CVE-2009-1720 — openexr - several vulnerabilities

描述

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information.

如何修補 CVE-2009-1720

要修補 CVE-2009-1720,請將受影響套件升級到下列已修補版本。

Debian/openexr—升級至 1.6.1-4.1 或更新版本
Debian/openexr—升級至 1.2.2-4.3+etch2 或更新版本

CVE-2009-1720 正在被利用嗎?

中等 — EPSS 為 6.4%,可持續追蹤但非最高優先。

受影響套件(2)

from 0, < 1.6.1-4.1
from 0, < 1.2.2-4.3+etch2

參考連結(1)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-1720