CVE-2021-45942
Fixed in a distro release EPSS 2%
OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
Products: openexr, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | openexr | 2.2.1-4.1+deb10u2 |
| Debian 11 | openexr | 2.5.4-2+deb11u1 |
| Debian 12 | openexr | 3.1.5-2 |
| Debian 13 | openexr | 3.1.5-2 |
| Debian 14 | openexr | 3.1.5-2 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP3 | openexr | 2.2.1-3.41.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | openexr | 2.2.1-3.41.1 |
| SUSE Linux Enterprise Server 12 SP5 | openexr | 2.1.0-6.45.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | openexr | 2.1.0-6.45.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | openexr | 2.1.0-6.45.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP5 | openexr | 2.1.0-6.45.1 |
| SUSE Package Hub 15 SP3 | cobbler | 3.1.2-bp153.2.3.1 |
| Ubuntu 25.10 | openexr | no fix |
| Ubuntu 26.10 | openexr | no fix |
| Ubuntu Pro 16.04 LTS | openexr | no fix |
| Ubuntu Pro 18.04 LTS | openexr | no fix |
| Ubuntu Pro 20.04 LTS | openexr | no fix |
| Ubuntu Pro 22.04 LTS | openexr | no fix |
| Ubuntu Pro 24.04 LTS | openexr | no fix |
| Ubuntu Pro 26.04 LTS | openexr | no fix |
| openSUSE Leap 15.3 | cobbler | 3.1.2-bp153.2.3.1 |
| openSUSE Leap 15.3 | openexr | 2.2.1-3.41.1 |