CVE-2009-1721
Fixed in a distro release EPSS 4%
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
Products: openexr, opensuse, apple mac_os_x, debian_linux, canonical ubuntu_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openexr | 1.6.1-4.1 |
| Debian 13 | openexr | 1.6.1-4.1 |
| Debian 14 | openexr | 1.6.1-4.1 |
| Debian 4.0 | openexr | 1.2.2-4.3+etch2 |
| Debian 5.0 | openexr | 1.6.1-3+lenny3 |