CVE-2021-3478

Katalog CVE

CVSS 5.5 · Medium EPSS 0,96%

Kerentanan Uncontrolled Resource Consumption pada openexr, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability.

Rincian

Terbit di NVD

31 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1939160 issue tracking · patch · advisory pihak ketiga
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-27 advisory pihak ketiga