CVE-2017-9114
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause...
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
CVE-2017-9114- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
CVE-2017-9114- Updated
- 2026-11-02
EUVDEUVD-2017-18052 No score
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
EUVD-2017-18052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fqq4-jr8p-g7pr
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause...
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
GHSA-fqq4-jr8p-g7pr- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
CVE-2017-9114- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-9114
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
- Record
DEBIAN-CVE-2017-9114- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1060
OpenEXR security update
OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light & Magic for use in computer imaging applications.
Security Fix(es):
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.(CVE-2017-9114)
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.(CVE-2017-9110)
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.(CVE-2017-9112)
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.(CVE-2017-9111)
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.(CVE-2017-9116)
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.(CVE-2017-9115)
In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.(CVE-2017-9113)
In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.(CVE-2017-12596)
- Record
OESA-2021-1060- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:0585-1 No score
Security update for openexr
This update for openexr fixes the following issues:
- CVE-2017-9110: In OpenEXR, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash. (bsc#1040107)
- CVE-2017-9114: In OpenEXR, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash. (bsc#1040114)
- CVE-2017-12596: In OpenEXR, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it could have resulted in denial of service or possibly unspecified other impact. (bsc#1052522)
- Record
SUSE-SU-2018:0585-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0587-1 No score
Security update for OpenEXR
This update for OpenEXR fixes the following issues:
- CVE-2017-9110: In OpenEXR, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash. (bsc#1040107)
- CVE-2017-9114: In OpenEXR, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash. (bsc#1040114)
- CVE-2017-12596: In OpenEXR, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it could have resulted in denial of service or possibly unspecified other impact. (bsc#1052522)
- Record
SUSE-SU-2018:0587-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openexrDebian:12 |
before 2.2.0-11.1 | 2.2.0-11.1 |
openexrDebian:13 |
before 2.2.0-11.1 | 2.2.0-11.1 |
openexrDebian:14 |
before 2.2.0-11.1 | 2.2.0-11.1 |
openexrDebian:7 |
before 1.6.1-6+deb7u1, plus listed versions 1.6.1-6 |
1.6.1-6+deb7u1 |
openexrDebian:9 |
before 2.2.0-11+deb9u1, plus listed versions 2.2.0-11 |
2.2.0-11+deb9u1 |
OpenEXRopenEuler:20.03-LTS |
before 2.2.0-18.oe1 | 2.2.0-18.oe1 |
OpenEXRopenEuler:20.03-LTS-SP1 |
before 2.2.0-18.oe1 | 2.2.0-18.oe1 |
openexrSUSE:Linux Enterprise Desktop 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openexrSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Server 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Server 12 SP3 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
openexrSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 2.1.0-6.3.1 | 2.1.0-6.3.1 |
OpenEXRSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.6.1-83.17.3.1 | 1.6.1-83.17.3.1 |
OpenEXRSUSE:Linux Enterprise Server 11 SP4 |
before 1.6.1-83.17.3.1 | 1.6.1-83.17.3.1 |
OpenEXRSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.6.1-83.17.3.1 | 1.6.1-83.17.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9114 is a medium vulnerability (CVSS 6.5) in Openexr, published May 21, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile. Fixed in openexr 2.2.0-11.1.
References
openwall.com/lists/oss-security/2017/05/12/5
github.com/openexr/openexr/releases/tag/v2.2.1
debian.org/security/2020/dsa-4755
lists.debian.org/debian-lts-announce/2020/08/msg00056.html
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-9114
security-tracker.debian.org/tracker/CVE-2017-9114
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1060
suse.com/support/update/announcement/2018/suse-su-20180585-1
bugzilla.suse.com/1040107