{"id":"CVE-2021-26260","aliases":["ALPINE-CVE-2021-26260","AZL-44169","DEBIAN-CVE-2021-26260","DLA-2701-1","DLA-3236-1","DSA-5299-1","EUVD-2021-13077","GHSA-mr39-xfw3-r82c","MGASA-2021-0326","OESA-2021-1238","SUSE-SU-2021:1489-1","UBUNTU-CVE-2021-26260","USN-4996-1","USN-4996-2","USN-5620-1","openSUSE-SU-2021:0670-1"],"status":"published","title":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR...","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01054,"percentile":0.64809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-191","CWE-400"],"published":"2021-05-04T15:10:26Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openexr","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openexr","fixed_in":["2.5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openexr","fixed_in":["2.5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["2.5.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","fixed_in":["2.2.0-10ubuntu2.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openexr","fixed_in":["2.2.0-11.1ubuntu1.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","fixed_in":["2.3.0-6ubuntu0.5+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.0-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11+deb9u3"}]}],"versions":["2.2.0-11","2.2.0-11+deb9u1","2.2.0-11+deb9u2"],"bundled":11},{"source":"osv","ecosystem":"Debian:10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-4.1+deb10u2"}]}],"versions":["2.2.1-4.1","2.2.1-4.1+deb10u1"],"bundled":22},{"source":"osv","ecosystem":"Debian:11","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1"}]}],"versions":["2.5.4-2"],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-2.4.mga7"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:8","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1.mga8"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-20.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-3.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-3.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-10ubuntu2.6+esm1"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.7"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-6ubuntu0.5+esm1"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-11.1ubuntu1.7"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-10ubuntu2.6+esm1"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-6ubuntu0.5+esm1"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-1ubuntu0.1~esm1"}]}],"versions":["2.5.4-2","2.5.7-1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-lp152.7.14.1"}]}],"bundled":5}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openexr","product":"openexr"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947582","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5299","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26260","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXFLD4ZAXKAIWO6ZPBCQEEDZB5IG676K/"},{"url":"https://github.com/advisories/GHSA-mr39-xfw3-r82c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-26260","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26260","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0326.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29005","tags":["report"]},{"url":"https://www.openexr.com/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4900-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4996-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4KYNJSMVA6YJY5NMKDZ5SAISKZG2KCKC/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23169","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211489-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184353","tags":["report"]},{"url":"https://bugzilla.suse.com/1184354","tags":["report"]},{"url":"https://bugzilla.suse.com/1184355","tags":["report"]},{"url":"https://bugzilla.suse.com/1185216","tags":["report"]},{"url":"https://bugzilla.suse.com/1185217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3479","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-26260","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26260","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/894","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4996-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5620-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3941","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XRXYHURHLDTSCIDOVAICJNNLPZTJP6NQ/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T00:00:00Z","modified":"2024-08-03T20:19:20.135Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13077","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T00:00:00Z","modified":"2024-08-03T20:19:20Z","updated_at":"2026-11-03T03:24:51.962182Z"}],"ghsa":[{"id":"GHSA-mr39-xfw3-r82c","title":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR...","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2022-05-24T19:04:22Z","modified":"2023-01-27T05:04:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190","CWE-191","CWE-400"],"updated_at":"2026-11-02T14:42:29.387682Z"}],"nvd":[{"id":"CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:10.79Z","modified":"2026-06-17T03:43:01.42Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-190"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"ALPINE-CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:10.79Z","modified":"2026-11-03T06:32:38.726719517Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"AZL-44169","title":"CVE-2021-26260 affecting package OpenEXR 2.3.0-6","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:10.79Z","modified":"2026-10-24T10:30:23.524883629Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:10.79Z","modified":"2026-10-23T18:02:57.575435471Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"OESA-2021-1238","title":"OpenEXR security update","description":"OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light \u0026amp; Magic for use in computer imaging applications.\r\n\r\nSecurity Fix(es):\r\n\r\nAn integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.(CVE-2021-26260)\r\n\r\nAn integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.(CVE-2021-23215)\r\n\r\nA heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.(CVE-2021-23169)","status":"published","published":"2021-06-26T11:04:28Z","modified":"2026-08-18T01:15:44.799626049Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-26260","description":"An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.","status":"published","published":"2021-06-08T12:15:00Z","modified":"2026-04-22T12:50:34.829199Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2701-1","title":"openexr - security update","status":"published","published":"2021-07-03T00:00:00Z","modified":"2026-03-09T01:23:39.093746Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3236-1","title":"openexr - security update","status":"published","published":"2022-12-12T00:00:00Z","modified":"2026-03-09T01:21:37.851393Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5299-1","title":"openexr - security update","status":"published","published":"2022-12-10T00:00:00Z","modified":"2026-03-09T02:08:37.544953Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0326","title":"Updated openexr packages fix security vulnerabilities","description":"Updated openexr packages fix security vulnerabilities:\n\nIt was discovered that OpenEXR incorrectly handled certain malformed EXR\nimage files. If a user were tricked into opening a crafted EXR image file,\na remote attacker could cause a denial of service, or possibly execute\narbitrary code (CVE-2021-3474, CVE-2021-3475, CVE-2021-3476, CVE-2021-3477,\nCVE-2021-3478, CVE-2021-3479, CVE-2021-3598, CVE-2021-3605, CVE-2021-20296,\nCVE-2021-23169, CVE-2021-23215, CVE-2021-26260).\n","status":"published","published":"2021-07-10T12:56:54Z","modified":"2026-04-16T04:42:39.83798364Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0670-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2021-23215: Fixed an integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185216).\n- CVE-2021-26260: Fixed an Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185217).\n- CVE-2021-20296: Fixed a  Null Pointer dereference in Imf_2_5:hufUncompress (bsc#1184355).\n- CVE-2021-3477: Fixed a Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts (bsc#1184353).\n- CVE-2021-3479: Fixed an Out-of-memory caused by allocation of a very large buffer (bsc#1184354).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-05-05T11:24:32Z","modified":"2026-02-04T04:02:20.926128Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:1489-1","title":"Security update for openexr","description":"This update for openexr fixes the following issues:\n\n- CVE-2021-23215: Fixed an integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185216).\n- CVE-2021-26260: Fixed an Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185217).\n- CVE-2021-20296: Fixed a  Null Pointer dereference in Imf_2_5:hufUncompress (bsc#1184355).\n- CVE-2021-3477: Fixed a Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts (bsc#1184353).\n- CVE-2021-3479: Fixed an Out-of-memory caused by allocation of a very large buffer (bsc#1184354).\n","status":"published","published":"2021-05-04T15:10:26Z","modified":"2025-05-02T04:31:03.850629Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4996-1","title":"openexr vulnerabilities","description":"It was discovered that OpenEXR incorrectly handled certain malformed EXR\nimage files. If a user were tricked into opening a crafted EXR image file,\na remote attacker could cause a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2021-06-22T11:09:05Z","modified":"2026-04-22T10:15:55.115088Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-4996-2","title":"openexr vulnerabilities","description":"USN-4996-1 fixed several vulnerabilities in OpenEXR. This update provides\nthe corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that OpenEXR incorrectly handled certain malformed EXR\n image files. If a user were tricked into opening a crafted EXR image file,\n a remote attacker could cause a denial of service, or possibly execute\n arbitrary code.\n","status":"published","published":"2021-06-22T11:46:27Z","modified":"2026-06-25T13:30:38.949163132Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5620-1","title":"openexr vulnerabilities","description":"It was discovered that OpenEXR incorrectly handled certain malformed EXR\nimage files. If a user were tricked into opening a crafted EXR image file,\na remote attacker could cause a denial of service, or possibly execute\narbitrary code. These issues only affected Ubuntu 20.04 ESM. (CVE-2021-3598,\nCVE-2021-3605, CVE-2021-20296, CVE-2021-23215, CVE-2021-26260)\n\nIt was discovered that OpenEXR incorrectly handled certain EXR\nimage files. An attacker could possibly use this issue to cause a crash\nor execute arbitrary code. (CVE-2021-3933)\n\nIt was discovered that OpenEXR incorrectly handled certain EXR image files.\nAn attacker could possibly use this issue to cause a crash. (CVE-2021-3941)\n","status":"published","published":"2022-09-20T12:52:57Z","modified":"2026-04-27T16:32:21.18739305Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}