Every CVE Search/ Get API key

CVE-2020-15304

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid...

5.5 MediumFix available

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Down 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
CVE-2020-15304
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
CVE-2020-15304
Updated
2026-11-02
EUVDEUVD-2020-7301 No score

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
EUVD-2020-7301
Updated
2026-11-03
GitHub AdvisoriesGHSA-9rrf-xw5h-f29c 5.5

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid...

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
GHSA-9rrf-xw5h-f29c
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2020-15304 5.5

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
ALPINE-CVE-2020-15304
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-45090 5.5

CVE-2020-15304 affecting package OpenEXR 2.3.0-6

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
AZL-45090
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
Show 7 moreShow less
OSV 5.5

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
CVE-2020-15304
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-15304 5.5

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.

Record
DEBIAN-CVE-2020-15304
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0015 No score

Updated openexr packages fix security vulnerabilities

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference (CVE-2020-15304).

An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp (CVE-2020-15305).

An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp (CVE-2020-15306).

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16587).

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16588).

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16589).

Record
MGASA-2021-0015
Updated
2026-11-02
OSVopenSUSE-SU-2020:0970-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466).
  • CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467).
  • CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0970-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1015-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466).
  • CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467).
  • CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469).
Record
openSUSE-SU-2020:1015-1
Updated
2026-11-02
OSVSUSE-SU-2020:1931-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466).
  • CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467).
  • CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469).
Record
SUSE-SU-2020:1931-1
Updated
2026-11-02
OSVSUSE-SU-2020:1984-1 No score

Security update for openexr

This update for openexr fixes the following issues:

  • CVE-2020-15304: Fixed a NULL pointer dereference in TiledInputFile:TiledInputFile() (bsc#1173466).
  • CVE-2020-15305: Fixed a use-after-free in DeepScanLineInputFile:DeepScanLineInputFile() (bsc#1173467).
  • CVE-2020-15306: Fixed a heap buffer overflow in getChunkOffsetTableSize() (bsc#1173469).
Record
SUSE-SU-2020:1984-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
Alpine:v3.12
 before 2.4.1-r3
2.4.1-r3
openexr
Alpine:v3.13
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.14
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.15
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.16
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.17
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.18
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.19
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.20
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.21
 before 2.5.2-r0
2.5.2-r0
Show 16 moreShow less
Affected packages
PackageAffectedFixed
openexr
Alpine:v3.22
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.23
 before 2.5.2-r0
2.5.2-r0
openexr
Alpine:v3.24
 before 2.5.2-r0
2.5.2-r0
OpenEXR
Azure Linux:3
 through 2.3.0-6 None known
openexr
Debian:12
 before 2.5.3-2
2.5.3-2
openexr
Debian:13
 before 2.5.3-2
2.5.3-2
openexr
Debian:14
 before 2.5.3-2
2.5.3-2
openexr
Mageia:7
From an advisory covering 6 CVEs
 before 2.3.0-2.3.mga7
2.3.0-2.3.mga7
openexr
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 3 CVEs
 before 2.2.1-3.18.1
2.2.1-3.18.1
openexr
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 3 CVEs
 before 2.2.1-3.18.1
2.2.1-3.18.1
openexr
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.23.1
2.1.0-6.23.1
openexr
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.23.1
2.1.0-6.23.1
openexr
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.23.1
2.1.0-6.23.1
openexr
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.23.1
2.1.0-6.23.1
openexr
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 2.2.1-lp151.4.12.1
2.2.1-lp151.4.12.1
openexr
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 2.2.1-lp152.7.5.1
2.2.1-lp152.7.5.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15304 is a medium vulnerability (CVSS 5.5) in Openexr, published June 26, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in openexr 2.4.1-r3.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open