The remote host is affected by the vulnerability described in GLSA-202210-31 (OpenEXR: Multiple Vulnerabilities)

  - A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted     file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this     vulnerability is to system availability. (CVE-2021-20304)

  - A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1.
    An attacker could use this flaw to execute arbitrary code with the permissions of the user running the     application compiled against OpenEXR. (CVE-2021-23169)

  - There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker     who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds     read. The greatest risk from this flaw is to application availability. (CVE-2021-3598)

  - There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is     able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The     greatest risk from this flaw is to application availability. (CVE-2021-3605)

  - An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits.
    This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with     application stability or lead to other attack paths. (CVE-2021-3933)

  - In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 -     chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the     divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition     which could affect the availability of programs linked with OpenEXR. (CVE-2021-3941)

  - OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called     from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE:
    db217f2 may be inapplicable. (CVE-2021-45942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer (CVE-2021-23169)

  - In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in     IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly     unspecified other impact. (CVE-2017-12596)

  - Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of     service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile     function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this     vulnerability isn't valid (CVE-2017-14988)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

远程主机受到 GLSA-202210-31 中所述漏洞的影响（OpenEXR：多个漏洞）

  - 在 OpenEXR 的 hufDecode 功能中发现一个缺陷。此漏洞允许攻击者将精心制作的文件传递给 OpenEXR 处理，从而触发未定义的右移错误。此漏洞最大的威胁在于系统可用性。(CVE-2021-20304)

  - 在 3.0.1 之前版本的 OpenEXR 的 copyIntoFrameBuffer 函数中发现堆缓冲区溢出。
    攻击者可以利用此缺陷，使用运行针对 OpenEXR 编译的应用程序的用户所具有的权限，执行任意代码。(CVE-2021-23169)

  - OpenEXR  3.0.5 之前版本的 ImfDeepScanLineInputFile 功能中存在缺陷。如果攻击者可将构建文件提交至与 OpenEXR 链接的应用程序，则可造成越界读取。此缺陷对应用程序可用性风险最大。(CVE-2021-3598)

  - OpenEXR  3.0.5 之前版本的 rleUncompress 功能中存在缺陷。如果攻击者可将构建文件提交至与 OpenEXR 链接的应用程序，则可造成越界读取。此缺陷对应用程序可用性风险最大。(CVE-2021-3605)

  - OpenEXR 在 size_t < 64 位的系统上处理构建的文件时，可能发生整数溢出。
    这可造成 bytesPerLine 和 maxBytesPerLine 值无效，进而导致应用程序稳定性问题或引发其他攻击路径。 (CVE-2021-3933)

  - 在 ImfChromaticities.cpp 例程 RGBtoXYZ() 中，存在一些除法运算，例如 `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` 和 `chroma。 green.y * (X + Z))) / d;`，但未检查除数中的 0 值。特别构建的文件可触发除以零的情况，从而影响与 OpenEXR 链接的程序的可用性。(CVE-2021-3941)

  - 3.1.4 之前的 OpenEXR 3.1.x 在执行调用自  IlmThread_3_1::NullThreadPoolProvider::addTask 和 IlmThread_3_1::ThreadPool::addGlobalTask  的 Imf_3_1::LineCompositeTask::execute  时有一个基于堆的缓冲区溢出。注意：
    db217f2 可能不适用。(CVE-2021-45942)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機受到 GLSA-202210-31 中所述的弱點影響 (OpenEXR：多個弱點)

  - 在 OpenEXR 的 hufDecode 功能中發現一個缺陷。攻擊者可以藉由傳送特製的檔案給 OpenEXR 處理，來觸發不明的右移錯誤。此弱點對系統可用性威脅最大。(CVE-2021-20304)

  - 在 OpenEXR 3.0.1 之前版本的 copyIntoFrameBuffer 函式中發現堆積型緩衝區溢位弱點。
    攻擊者可利用此弱點，以執行針對 OpenEXR 編譯的應用程式之使用者的權限執行任意程式碼。(CVE-2021-23169)

  - 在 OpenEXR 3.0.5 之前版本的 ImfDeepScanLineInputFile 功能中有一個缺陷。若攻擊者能將特製的檔案提交給與 OpenEXR 連結的應用程式，就可能會造成超出邊界讀取。此缺陷對應用程式的可用性影響最大。(CVE-2021-3598)

  - 在 OpenEXR 3.0.5 之前版本的 rleUncompress 功能中發現一個缺陷。若攻擊者能將特製的檔案提交給與 OpenEXR 連結的應用程式，就可能會造成超出邊界讀取。此缺陷對應用程式的可用性影響最大。(CVE-2021-3605)

  - OpenEXR 在 size_t < 64 位元的系統上處理特製檔案時，可能會發生整數溢位。
    這可造成無效的 bytesPerLine 和 maxBytesPerLine 值，進而導致應用程式穩定性問題或其他攻擊路徑。(CVE-2021-3933)

  - ImfChromaticities.cpp 常式 RGBtoXYZ() 中有一些除法運算，例如 `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` 和 `chroma. Green.y * (X + Z))) / d;`，但系統未檢查除數是否有 0 值。特製的檔案可觸發除以零情形，進而影響與 OpenEXR 連結之程式的可用性。(CVE-2021-3941)

  - 在 OpenEXR 3.1.4 之前的 3.1.x 版中，Imf_3_1: : LineCompositeTask: : execute 中存在堆積型緩衝區溢位弱點 (從 IlmThread_3_1: : NullThreadPoolProvider：: addTask 和 IlmThread_3_1: : ThreadPool: : addGlobalTask 呼叫)。注意：
    db217f2 可能不適用。(CVE-2021-45942)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer (CVE-2021-23169)

  - OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841)

  - OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by     exrmultiview. (CVE-2018-18443)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
166712	GLSA-202210-31 : OpenEXR: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	high
199476	RHEL 7 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
166712	GLSA-202210-31 : OpenEXR：多个漏洞	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	high
166712	GLSA-202210-31：OpenEXR：多個弱點	Nessus	Gentoo Local Security Checks	2022/10/31	2023/10/6	high
199439	RHEL 8 : openexr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical

検出

プラグインの検索

high

high

high

high

critical