Vulnerability Description
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
CVSS Score
5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openexr | Openexr | < 2.4.1 |
| Fedoraproject | Fedora | 32 |
| Canonical | Ubuntu Linux | 16.04 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 9.0 |
| Apple | Icloud | < 7.20 |
| Apple | Itunes | < 12.10.8 |
| Apple | Ipados | < 13.6 |
| Apple | Iphone Os | < 13.6 |
| Apple | Mac Os X | < 10.15.6 |
| Apple | Tvos | < 13.4.8 |
| Apple | Watchos | < 6.2.8 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.htmlMailing ListThird Party Advisory
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1987ExploitThird Party Advisory
- https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#versRelease NotesThird Party Advisory
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00056.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202107-27Third Party Advisory
- https://support.apple.com/kb/HT211288Third Party Advisory
- https://support.apple.com/kb/HT211289Third Party Advisory
- https://support.apple.com/kb/HT211290Third Party Advisory
- https://support.apple.com/kb/HT211291Third Party Advisory
- https://support.apple.com/kb/HT211293Third Party Advisory
- https://support.apple.com/kb/HT211294Third Party Advisory
- https://support.apple.com/kb/HT211295Third Party Advisory
- https://usn.ubuntu.com/4339-1/Third Party Advisory
FAQ
What is CVE-2020-11758?
CVE-2020-11758 is a vulnerability with a CVSS score of 5.5 (MEDIUM). An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
How severe is CVE-2020-11758?
CVE-2020-11758 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-11758?
Check the references section above for vendor advisories and patch information. Affected products include: Openexr Openexr, Fedoraproject Fedora, Canonical Ubuntu Linux, Opensuse Leap, Debian Debian Linux.