This update for openexr fixes the following issues :

CVE-2017-14988: Fixed a denial of service in Header::readfrom() (bsc#1061305).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

このopenexrの更新では、次の問題が修正されます：

CVE-2017-14988：Headerでサービス拒否を修正しました：: readfrom()（bsc#1061305）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

远程 Redhat Enterprise Linux 7 主机上安装的一个或多个程序包受到供应商已确认但并未提供补丁的多个漏洞影响。

  - OpenEXR：= 运算符函数中的越界写入 (CVE-2017-9115)

  - 在 OpenEXR 2.2.0 中，构建的图像导致 IlmImf/ImfHuf.cpp 中的 hufDecode 函数在 exrmaketiled 执行期间发生基于堆的缓冲区过度读取；它可能导致拒绝服务或其他不明影响。(CVE-2017-12596)

  - OpenEXR 2.2.0 中，IlmImf/ImfHeader.cpp 中的 Header::readfrom 允许远程攻击者通过可使用 IlmImf/ImfCRgbaFile.cpp 中的 ImfOpenInputFile 函数访问的构建文件造成拒绝服务（过量内存分配）。注意：维护者和多个第三方认为此漏洞无效 (CVE-2017-14988)

请注意，Nessus 并未测试这些问题，而是依赖于程序包管理器报告是否已安装程序包。

遠端 Redhat Enterprise Linux 7 主機安裝了一個或多個受到多個弱點影響的套件，供應商已確認這些弱點不會得到修補。

  - OpenEXR：= 運算子函式中的超出邊界寫入問題 (CVE-2017-9115)

  - 在 OpenEXR 2.2.0 中，特製的影像會在 exrmaketiled 執行期間，造成 IlmImf/ImfHuf.cpp 中的 hufDecode 函式發生堆積型緩衝區過度讀取；這可能會導致拒絕服務，或可能造成其他不明影響。(CVE-2017-12596)

  - 在 OpenEXR 2.2.0 中，IlmImf/ImfHeader.cpp 中的 Header::readfrom 允許遠端攻擊者透過使用 IlmImf/ImfCRgbaFile.cpp 中的 ImfOpenInputFile 函式存取的特製檔案，造成拒絕服務 (過度記憶體配置)。注意：維護者和多個第三方認為此弱點無效 (CVE-2017-14988)

請注意，Nessus 並未測試這些問題，而是依據套件管理員已安裝套件的報告。

このopenexrの更新では、次の問題が修正されます：

  - CVE-2017-14988：Headerでサービス拒否を修正しました：: readfrom()（bsc#1061305）。

この更新はSUSEからインポートされました：SLE-15：更新プロジェクトを更新します。

リモートの Redhat Enterprise Linux 7 ホストには、1 つ以上のパッケージがインストールされており、これらのパッケージは複数の脆弱性の影響を受けます。これらの脆弱性はベンダーによって認識されていますが、パッチが適用されません。

  - OpenEXR: = 演算子関数での領域外書き込み (CVE-2017-9115)

  - OpenEXR 2.2.0 で、細工された画像が、exrmaketiled 実行中に IlmImf/ImfHuf.cpp の hufDecode 関数でヒープベースのバッファオーバーリードを引き起こします。これにより、サービス拒否が発生したり、詳細不明なその他の影響を与える可能性があります。(CVE-2017-12596)

  - OpenEXR 2.2.0 の IlmImf/ImfHeader.cpp の Header::readfrom により、リモートの攻撃者が、IlmImf/ImfCRgbaFile.cpp の ImfOpenInputFile 関数でアクセスされる細工されたファイルを介して、サービス拒否 (過剰なメモリ割り当て) を引き起こすことが可能です。注意: メンテナーおよび複数のサードパーティは、この脆弱性は有効ではないと考えています (CVE-2017-14988)

注意: Nessus はこれらの問題をテストしておらず、代わりにパッケージがインストールされているというパッケージマネージャーのレポートに依存しています。

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR     2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted     file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The     maintainer and multiple third parties believe that this     vulnerability isn't valid.(CVE-2017-14988)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     getBits function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9112)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     refill function in ImfFastHuf.cpp could cause the     application to crash.(CVE-2017-9114)

  - In OpenEXR 2.2.0, an invalid read of size 1 in the     uncompress function in ImfZip.cpp could cause the     application to crash.(CVE-2017-9116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Out-of-bounds write in the = operator function (CVE-2017-9115)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Out-of-bounds write in the = operator function (CVE-2017-9115)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for openexr fixes the following issues :

  - CVE-2017-14988: Fixed a denial of service in     Header::readfrom() (bsc#1061305).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the OpenEXR package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - OpenEXR is a high dynamic-range (HDR) image file format     developed by Industrial Light & Magic for use in     computer imaging applications. This package contains     libraries and sample applications for handling the     format.Security Fix(es):In OpenEXR 2.2.0, an invalid     write of size 2 in the = operator function in half.h     could cause the application to crash or execute     arbitrary code.(CVE-2017-9115)In OpenEXR 2.2.0, an     invalid write of size 8 in the storeSSE function in     ImfOptimizedPixelReading.h could cause the application     to crash or execute arbitrary code.(CVE-2017-9111)In     OpenEXR 2.2.0, a crafted image causes a heap-based     buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution it may     result in denial of service or possibly unspecified     other impact.(CVE-2017-12596)In OpenEXR 2.2.0, an     invalid write of size 1 in the bufferedReadPixels     function in ImfInputFile.cpp could cause the     application to crash or execute arbitrary     code.(CVE-2017-9113)In OpenEXR 2.2.0, an invalid read     of size 1 in the uncompress function in ImfZip.cpp     could cause the application to crash.(CVE-2017-9116)In     OpenEXR 2.2.0, an invalid read of size 1 in the refill     function in ImfFastHuf.cpp could cause the application     to crash.(CVE-2017-9114)In OpenEXR 2.2.0, an invalid     read of size 1 in the getBits function in ImfHuf.cpp     could cause the application to crash.(CVE-2017-9112)In     OpenEXR 2.2.0, an invalid read of size 2 in the     hufDecode function in ImfHuf.cpp could cause the     application to crash.(CVE-2017-9110)Header::readfrom in     IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote     attackers to cause a denial of service (excessive     memory allocation) via a crafted file that is accessed     with the ImfOpenInputFile function in     IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and     multiple third parties believe that this vulnerability     isn't valid.(CVE-2017-14988)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
127763	SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2019:2043-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
127763	SUSE SLED15 / SLES15セキュリティ更新プログラム：openexr（SUSE-SU-2019:2043-1）	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
127754	SUSE SLED12 / SLES12セキュリティ更新プログラム：openexr（SUSE-SU-2019:2014-1）	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
199476	RHEL 7：openexr（未修补的漏洞）	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/16	high
199476	RHEL 7：openexr (未修補的弱點)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/16	high
128016	openSUSEセキュリティ更新プログラム：openexr（openSUSE-2019-1954）	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	medium
199476	RHEL 7: openexr (パッチ未適用の脆弱性)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/16	high
127754	SUSE SLED12 / SLES12 Security Update : openexr (SUSE-SU-2019:2014-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
135545	EulerOS 2.0 SP3 : OpenEXR (EulerOS-SA-2020-1416)	Nessus	Huawei Local Security Checks	2020/4/15	2021/1/6	medium
199422	RHEL 6 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
199476	RHEL 7 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/16	high
128016	openSUSE Security Update : openexr (openSUSE-2019-1954)	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	medium
136862	EulerOS 2.0 SP8 : OpenEXR (EulerOS-SA-2020-1584)	Nessus	Huawei Local Security Checks	2020/5/26	2024/3/8	high

検出

プラグインの検索

medium

medium

medium

high

high

medium

high

medium

medium

high

high

medium

high