CVE-2017-14988
Fixed in a distro release EPSS 1%
Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid
Products: openexr
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openexr | 2.5.3-2 |
| Debian 13 | openexr | 2.5.3-2 |
| Debian 14 | openexr | 2.5.3-2 |
| SUSE Linux Enterprise Desktop 12 SP4 | openexr | 2.1.0-6.13.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | openexr | 2.2.1-3.9.2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP1 | openexr | 2.2.1-3.9.2 |
| SUSE Linux Enterprise Server 12 SP4 | openexr | 2.1.0-6.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openexr | 2.1.0-6.13.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | openexr | 2.1.0-6.13.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP4 | openexr | 2.1.0-6.13.1 |
| openSUSE Leap 15.0 | openexr | 2.2.1-lp151.4.6.1 |
| openSUSE Leap 15.1 | openexr | 2.2.1-lp151.4.6.1 |
| openSUSE Tumbleweed | openexr | 3.1.1-2.2 |