SB2021120144 - SUSE update for openexr

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2021-3477)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the deep tile sample size calculations. A remote attacker can create a specially crafted file, trigger out-of-bounds read error and read contents of memory on the system.

2) Integer overflow (CVE-ID: CVE-2021-3933)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow when processing files. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and perform a denial of service (DoS) attack.

Note, the vulnerability affects software installation on 32-bit systems.

3) Division by zero (CVE-ID: CVE-2021-3941)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero issue in Imf_3_1::RGBtoXYZ. A remote attacker can trick the victim to open a specially crafted file, trigger division by zero and crash the application.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2021/suse-su-20213843-1/