NetSight
IP …
medium5.5

CVE-2020-11765

An issue was discovered in OpenEXR before 2.4.1.

Impact

An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read.

Affected products

VendorProductAffected versions
OpenexrOpenexr
before 2.4.1
FedoraprojectFedora
Version 32
OpensuseLeap
Version 15.1
DebianDebian Linux
Versions 9.0, 10.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.10, 20.04
AppleIcloud
before 7.20
from 10.0 before 11.3
AppleItunes
before 12.10.8
AppleIpados
before 13.6
AppleIphone Os
before 13.6
AppleMac Os X
from 10.13.0 before 10.13.6
from 10.14.0 before 10.14.6
from 10.15 before 10.15.6
Versions 10.13.6, 10.14.6
AppleTvos
before 13.4.8
AppleWatchos
before 6.2.8

Weakness classification

CWE-125CWE-193

References