CVE-2021-3478
Summary
| CVE | CVE-2021-3478 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-03-31 14:15:00 UTC |
|---|
| Updated | 2022-12-13 01:57:00 UTC |
|---|
| Description | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| OpenEXR: Multiple vulnerabilities (GLSA 202107-27) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] [DLA 3236-1] openexr security update |
MLIST |
lists.debian.org |
|
| [SECURITY] [DLA 2701-1] openexr security update |
MLIST |
lists.debian.org |
|
| 27409 -
oss-fuzz -
OSS-Fuzz: Fuzzing the planet -
Monorail |
MISC |
bugs.chromium.org |
|
| 1939160 – (CVE-2021-3478) CVE-2021-3478 OpenEXR: Out-of-memory in ScanLineInputFile |
MISC |
bugzilla.redhat.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178693 Debian Security Update for openexr (DLA 2701-1)
- 179860 Debian Security Update for openexr (CVE-2021-3478)
- 181315 Debian Security Update for openexr (DLA 3236-1)
- 198318 Ubuntu Security Notification for Openexr Vulnerabilities (USN-4900-1)
- 501648 Alpine Linux Security Update for openexr
- 502133 Alpine Linux Security Update for openexr
- 672178 EulerOS Security Update for openexr (EulerOS-SA-2022-2475)
- 690438 Free Berkeley Software Distribution (FreeBSD) Security Update for openexr, ilmbase (98044aba-6d72-11eb-aed7-1b1b8a70cc8b)
- 710048 Gentoo Linux OpenEXR Multiple Vulnerabilities (GLSA 202107-27)
