Description
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a openexr
OpenEXR 3.1.2affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2019783 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/ ↗
- https://security.gentoo.org/glsa/202210-31 ↗
- https://www.debian.org/security/2022/dsa-5299 ↗
- https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html ↗