UBUNTU-CVE-2020-11759

Details

An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer.

Affected Packages

openexr

Ubuntu 16.04 LTS

Fixed in:

2.2.0-10ubuntu2.2

openexr

Ubuntu 18.04 LTS

Fixed in:

2.2.0-11.1ubuntu1.2

openexr

Ubuntu 20.04 LTS

Fixed in:

2.3.0-6ubuntu0.1

References

REPORT

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020

REPORT

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1

REPORT

https://ubuntu.com/security/CVE-2020-11759

ADVISORY

https://ubuntu.com/security/notices/USN-4339-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2020-11759