CVE-2020-11762

Katalog CVE

CVSS 5.5 · Medium EPSS 1,8%

Kerentanan Out-of-bounds Read pada openexr, fedoraproject fedora +10 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.

Rincian

Terbit di NVD

14 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html mailing list · advisory pihak ketiga
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1987 exploit · advisory pihak ketiga
• https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020 release notes · advisory pihak ketiga
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-27 advisory pihak ketiga
• https://support.apple.com/kb/HT211288 advisory pihak ketiga
• https://support.apple.com/kb/HT211289 advisory pihak ketiga
• https://support.apple.com/kb/HT211290 advisory pihak ketiga
• https://support.apple.com/kb/HT211291 advisory pihak ketiga
• https://support.apple.com/kb/HT211293 advisory pihak ketiga
• https://support.apple.com/kb/HT211294 advisory pihak ketiga
• https://support.apple.com/kb/HT211295 advisory pihak ketiga
• https://usn.ubuntu.com/4339-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4755 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYA...